[ { "ioc": "210.68.242.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-21T23:59:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:00:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.172.175.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-21T23:59:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:51:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1390, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.97.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:03:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:52:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.86.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:03:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:04:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.105.142.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:05:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T08:29:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.214.161.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:11:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:23:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.100.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:19:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:20:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.132.224.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:20:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:23:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.13", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-22T00:26:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:34:29Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 130, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "182.208.1.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:34:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:36:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.148.19.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:35:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:36:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.29", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-22T00:39:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:29:19Z" }, "ports": [ 53, 0, 1900, 5632, 161, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 37082, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "221.160.4.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:50:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.177.103.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:52:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:53:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.157.61.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T00:54:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T00:57:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.178.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T01:12:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:54:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.241.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T01:47:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T01:47:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.126.184.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T01:57:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:41:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 2117, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.125.11.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T02:14:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T02:14:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.224.128.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T02:27:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:57:19Z" }, "ports": [ 80, 0 ], "reporting_nodes": 3, "rules": [ "(stream_tcp) data on SYN packet", "ET DROP Dshield Block Listed Source group 1", "SURICATA TCPv4 invalid checksum", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 654757, "tags": [ "tcp", "http", "alert", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "100.14.46.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T02:28:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T02:28:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.227.34.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T02:29:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:53:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 61, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "115.182.66.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T02:31:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:49:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21167, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.43.214.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T02:33:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:38:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 88" ], "sightings": 56, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.165.36.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T02:48:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:08:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 404, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.164.115.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T02:48:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T02:50:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.110.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T02:53:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T02:53:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.179.59.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T02:55:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T02:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.83.44.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T03:05:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:45:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4182, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.14.41.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T03:09:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T03:09:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T03:18:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:55:30Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 19944, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "125.229.19.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T03:20:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T03:21:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.137.36.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T03:32:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:23:36Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1159, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.12", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-22T03:41:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T03:44:57Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 130, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "221.147.254.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T03:45:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T03:48:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.152.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T03:57:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:25:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 590, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.203.11.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T04:10:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T04:10:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.118.191.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T04:10:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T04:13:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.16.208.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T04:14:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T04:17:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.60.58.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T04:26:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:59:37Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 316, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.247.169.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T04:35:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:50:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 426, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.164.230.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T05:09:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T05:10:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.29.238.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T05:30:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T05:32:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.185.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T05:42:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T05:43:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.62.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T05:48:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:08:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.175.167.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T06:01:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T06:02:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.225.148.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T06:10:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T17:59:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18875, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.151.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T06:15:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T06:15:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "70.191.130.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T06:21:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:49:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7600, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.37.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T06:29:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:36:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 55", "ET 3CORESec Poor Reputation IP group 39" ], "sightings": 697, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "174.76.52.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T06:54:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T15:24:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.152.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T07:13:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T07:15:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 31", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 80, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "220.132.139.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T07:18:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T07:19:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.129.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T07:22:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T07:22:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.205.59.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T07:27:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T07:28:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.131.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T07:48:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T07:48:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.232.98.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T07:48:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T07:50:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.196.144.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T07:50:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T07:52:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.21.243.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T07:51:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:44:46Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 57", "ET 3CORESec Poor Reputation IP group 40" ], "sightings": 9092, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "107.189.2.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T07:52:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T07:52:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.218.108.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T08:22:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T08:22:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.233.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T08:29:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:40:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22540, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.32.106.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T08:29:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:40:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1526, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.132.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T08:47:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T08:50:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.106.243.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T08:58:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T09:02:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.37.93", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-01-22T09:32:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T09:32:44Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 78, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "118.171.44.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T09:32:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T09:34:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.219.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T09:33:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:13:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 952, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.200.27.217", "classifications": [], "first_seen": { "$date": "2023-01-22T09:37:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T09:37:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "221.159.17.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T09:37:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:15:41Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1568, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.179.213.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T09:49:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T09:51:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.148", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-22T10:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T10:05:05Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 130, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.165.190.17", "classifications": [ "Executable code was detected", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-22T10:08:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:38:10Z" }, "ports": [ 22, 0, 161 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP public access udp" ], "sightings": 81729, "tags": [ "tcp", "ssh", "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "221.165.227.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T10:08:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:10:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.124.88.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T10:17:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T10:21:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.199.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T11:05:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T11:07:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.153.33.65", "classifications": [], "first_seen": { "$date": "2023-01-22T11:25:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:00:06Z" }, "ports": [ 22, 5682, 9172, 15420, 1371 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 2546, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "131.129.221.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T11:30:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T11:32:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.181.243.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T11:39:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T11:39:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.229.201.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T11:49:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T11:53:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 78, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.53.109.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T11:57:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T12:01:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.148", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-22T12:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:57:36Z" }, "ports": [ 80, 0, 177 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 7757, "tags": [ "tcp", "http", "icmp", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "179.43.143.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T12:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:36:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11622, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.198.65.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T12:12:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T12:14:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.172.160.51", "classifications": [], "first_seen": { "$date": "2023-01-22T12:14:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T12:14:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) partial start line" ], "sightings": 104, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "79.243.191.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T12:17:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T12:19:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.191", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-22T12:19:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:04:43Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 109721, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.140.176.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T12:28:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:42:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2980, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.14.136.78", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-22T12:32:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T12:36:19Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 130, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "122.116.65.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T12:36:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T12:39:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.19.191.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T13:05:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:57:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 572, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.160.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T13:06:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:07:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2408, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.13.37.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T13:15:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:06:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.184.159.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T13:31:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T13:32:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.149.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T13:40:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T13:40:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.112.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T13:45:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T13:48:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.47.2.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T13:49:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T13:50:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.174.92.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:00:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T14:00:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.253.34.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:01:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T14:01:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.114.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T14:09:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.170.3.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:17:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:26:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1370, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.45.127.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:23:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:49:50Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 8" ], "sightings": 7366, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "221.155.113.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:28:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T14:30:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.138.226.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:34:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T14:37:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.15.64.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:37:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T14:40:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "96.72.24.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:49:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T14:51:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.135.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T14:57:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T14:58:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.241.117.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T15:17:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T15:17:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.89.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T15:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T15:19:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.164.206.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T15:23:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T15:24:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.196.112.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T15:29:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:22:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1114, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.92.127.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T15:38:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T15:38:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.197.197.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T15:43:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T15:43:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.8.205.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T15:51:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:31:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 59" ], "sightings": 779, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.126.113.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T16:17:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T16:20:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.89.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T16:19:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T16:19:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.180.241.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T16:32:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T16:32:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "105.225.70.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T16:41:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T16:42:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 156, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.17.192.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T16:56:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:15:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 56" ], "sightings": 1881, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "183.99.124.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T16:59:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:54:28Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 597, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.192.8.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:01:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T06:06:02Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 2009, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "216.15.70.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:12:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T17:14:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.94.111.1", "classifications": [ "Misc activity", "Detection of a Network Scan", "Decode of an RPC Query", "Information Leak", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-22T17:19:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:40:00Z" }, "ports": [ 0, 1900, 111, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 1333108, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "snmp" ], "rule_count": 9, "classification_count": 5 }, { "ioc": "59.27.78.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:22:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:06:56Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 58" ], "sightings": 1576, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "119.153.110.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:23:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T17:25:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.41.233.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:24:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T17:25:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.150.194.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:25:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T17:27:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.136.163.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:30:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:18:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3853, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.3.63.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:33:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:11:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 790, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.103.144.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:42:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T17:42:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.33.24.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T17:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T17:42:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.226.47.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:46:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T17:49:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.102.251.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:52:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:00:43Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 749, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.136.225.9", "classifications": [], "first_seen": { "$date": "2023-01-22T17:59:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T17:59:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data sent on stream after TCP reset received" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.183.206.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T17:59:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:46:50Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 99", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1587, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "220.133.109.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:01:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:01:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.44.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:01:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.40.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:06:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:07:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.139.222.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:10:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.116.139.10", "classifications": [], "first_seen": { "$date": "2023-01-22T18:17:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:17:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.153.49.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:22:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:46:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 732, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.233.209.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:30:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:31:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.184.87.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:31:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.120.37.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:32:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:34:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.95.37.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:37:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:40:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.173.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:40:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:44:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "105.225.94.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:41:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:41:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.39.59.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:43:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.107.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:46:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:47:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.240.4", "classifications": [ "Misc activity", "Decode of an RPC Query", "Attempted Information Leak", "Detection of a Network Scan", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-22T18:50:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:42:15Z" }, "ports": [ 0, 111, 1434, 161, 1900, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-TFTP Get" ], "sightings": 5981058, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "snmp", "tftp" ], "rule_count": 8, "classification_count": 5 }, { "ioc": "75.36.0.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T18:54:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T18:56:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.34.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T18:59:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:33:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22258, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.59.101.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:04:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T19:04:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.26.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:04:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T19:06:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.111.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T19:05:37Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:07:24Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18588, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.108.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T19:06:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:38:25Z" }, "ports": [ 22, 0 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9416, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "119.194.42.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:12:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T19:12:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.193.209.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:13:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T19:13:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "100.37.189.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:13:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T19:14:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.118.254.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:16:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:23:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 353, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.151.30.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:19:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T19:22:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.48.159.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:23:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T19:24:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.218.164.191", "classifications": [], "first_seen": { "$date": "2023-01-22T19:40:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:53:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "ET CINS Active Threat Intelligence Poor Reputation IP group 99", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "invalid_banner", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 53, "tags": [ "tcp", "brute_force", "ssh", "alert", "anomaly", "Go", "Server" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "122.117.218.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T19:41:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T19:43:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.23.199.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T20:02:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:56:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1246, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.138.228.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T20:08:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T20:10:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.182.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T20:15:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:53:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1238, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "125.228.236.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T20:21:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:52:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8882, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.249.128.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T20:33:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T20:33:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T20:41:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:25:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20277, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.135.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T20:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:02:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 606, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.214.175.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T20:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:14:08Z" }, "ports": [ 0, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET 3CORESec Poor Reputation IP group 18" ], "sightings": 4307, "tags": [ "icmp", "alert", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "94.102.61.31", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-22T20:46:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:58:43Z" }, "ports": [ 53, 0, 1900, 111 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 399361, "tags": [ "udp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 4 }, { "ioc": "59.126.58.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T20:49:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:33:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2010, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.168.70.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:01:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:18:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.28.237.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:01:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:00:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1936, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.167.247.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:07:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:08:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.32.152.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:07:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:08:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.108.54.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:11:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:13:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.221.23.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:12:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:29:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1344, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.39.41.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:23:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:25:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.111.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:32:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:32:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.31.59.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:33:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:34:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.115.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:35:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:36:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.202", "classifications": [], "first_seen": { "$date": "2023-01-22T21:36:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:36:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.84.248.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:36:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:07:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 626, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.95.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:40:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:40:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.75.76.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:54:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:02:07Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 64" ], "sightings": 26719, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "125.228.160.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T21:58:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T21:59:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.249.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:00:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T22:02:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.127.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:04:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:15:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.148", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak", "Executable code was detected", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-22T22:08:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:23:52Z" }, "ports": [ 53, 0, 161, 22, 80, 5632, 1900 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET DROP Dshield Block Listed Source group 1", "APP-DETECT PCAnywhere server response", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 37243, "tags": [ "udp", "icmp", "snmp", "tcp", "ssh", "alert", "http" ], "rule_count": 12, "classification_count": 5 }, { "ioc": "205.210.31.10", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-22T22:08:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:36:36Z" }, "ports": [ 53, 0, 161, 80 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 64006, "tags": [ "udp", "icmp", "snmp", "alert", "tcp", "http" ], "rule_count": 9, "classification_count": 3 }, { "ioc": "115.134.42.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T22:20:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.211.9.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:19:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T22:20:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.125.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:27:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T22:29:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-22T22:29:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:02:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29971, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.192.31.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:46:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T22:49:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.202.41.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T22:53:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.177.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:54:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T23:53:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.144.209.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T22:57:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T22:59:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.192.247.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T23:06:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T23:06:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.45.114.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T23:09:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:03:19Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 8", "ET 3CORESec Poor Reputation IP group 13" ], "sightings": 12764, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "122.117.0.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T23:10:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:14:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1210, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.120.187.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T23:10:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T23:12:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.58.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T23:13:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:52:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 614, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.70.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T23:34:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T23:34:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.252.73.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T23:50:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T23:50:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.32.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-22T23:55:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-22T23:56:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.112.65.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:02:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:02:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.236.135.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:08:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T18:15:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 332798, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.39.103.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:12:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:04:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1434, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.146", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T00:16:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:45:54Z" }, "ports": [ 1434, 0, 22, 53, 161 ], "reporting_nodes": 3, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 24088, "tags": [ "udp", "icmp", "tcp", "ssh", "snmp", "alert" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "193.194.87.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:18:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:40:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12564, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "97.74.83.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:18:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2285, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.30.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:27:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1632, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.9.63.139", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:22:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:53:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2706555, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.73.169.169", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T00:24:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:59:59Z" }, "ports": [ 0, 161, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 159065, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "195.251.255.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:24:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:08:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2557853, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.57", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T00:25:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:59:32Z" }, "ports": [ 0, 80, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 19188, "tags": [ "icmp", "tcp", "http", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:27:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:51:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9420, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.218", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:34:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:15:48Z" }, "ports": [ 65476, 0, 1024, 1025, 1026, 5060 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16454, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.139.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:34:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:16:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15904, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.255.193.181", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:36:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:10:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 65870, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "157.148.98.30", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T00:36:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:20:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 38992, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "222.118.130.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:37:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:37:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.212.49.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:37:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:38:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.201.248.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:37:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:38:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.169.125.251", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:40:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3205916, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.70.23.193", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T00:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:44:37Z" }, "ports": [ 0, 69 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get" ], "sightings": 156, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "61.75.83.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:44:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:13:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 64" ], "sightings": 2431, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:45:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:38:31Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 27995, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "96.250.54.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:45:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:57:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 29271, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:46:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:41:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8907, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.241.175.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:48:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:48:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.9.29.131", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:50:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:27:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3109058, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.187.178.129", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:50:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:50:39Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.15.1.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:53:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:54:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 57410, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.45.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:54:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:54:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:54:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:34:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9022, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.251.235.155", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-23T00:55:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:31:21Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 322598, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.229.80.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T00:58:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:44:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3822, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.9.29.128", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:00:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:59:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1759743, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.110.42.253", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:02:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:45:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3242694, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.187.179.215", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:03:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:03:45Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "151.253.124.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:05:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:55:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36666, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.150", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak", "Executable code was detected", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T01:09:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:21:49Z" }, "ports": [ 161, 0, 53, 22, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 58934, "tags": [ "udp", "snmp", "icmp", "tcp", "ssh" ], "rule_count": 10, "classification_count": 5 }, { "ioc": "153.171.166.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:10:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:12:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.209.57.134", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T01:12:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:20:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 100543, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "183.242.65.13", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T01:15:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:14:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 29645, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "62.210.211.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:17:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:06:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19753, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.239.161.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:19:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:02:28Z" }, "ports": [ 5060, 0, 15060, 5061, 5062, 5063, 5064, 5069 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 64608, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:27:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:38:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.40.237.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:27:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:28:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.102.61.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:29:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:13:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 387390, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.245.40.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:37:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:37:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "(tcp) experimental TCP options found", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 78, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "205.210.31.28", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak", "Executable code was detected", "Information Leak" ], "first_seen": { "$date": "2023-01-23T01:37:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:16:04Z" }, "ports": [ 1900, 0, 80, 1434, 53, 161, 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET 3CORESec Poor Reputation IP group 27", "SQL ping attempt", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 74402, "tags": [ "udp", "icmp", "alert", "tcp", "http", "snmp", "ssh" ], "rule_count": 13, "classification_count": 5 }, { "ioc": "1.34.20.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:38:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:39:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.51.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:39:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:53:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28424, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.81.157.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:39:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:06:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.6", "classifications": [ "Executable code was detected", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T01:40:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:22:06Z" }, "ports": [ 22, 0, 5632, 53, 161, 1434 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 64513, "tags": [ "tcp", "ssh", "icmp", "udp", "snmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "104.244.79.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:40:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:00:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 90552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.159", "classifications": [ "Executable code was detected", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T01:40:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:09:10Z" }, "ports": [ 22, 0, 5632, 161, 53 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt" ], "sightings": 56110, "tags": [ "tcp", "ssh", "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "64.62.197.122", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T01:47:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:12:06Z" }, "ports": [ 0, 69, 80, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "ET DROP Dshield Block Listed Source group 1", "SQL ping attempt", "(stream_tcp) data on SYN packet" ], "sightings": 9065, "tags": [ "icmp", "udp", "tftp", "alert", "tcp", "http" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "71.6.135.131", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:47:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:55:42Z" }, "ports": [ 0, 161, 22, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt" ], "sightings": 68020, "tags": [ "icmp", "udp", "snmp", "tcp", "ssh" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "216.218.206.76", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T01:48:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:40:17Z" }, "ports": [ 69, 0, 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 16956, "tags": [ "udp", "tftp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "51.195.47.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:48:42Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:48:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12218, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.142.76.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:55:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:26:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1356, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.123.211.33", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T01:55:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:19:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 69820, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "175.208.69.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:56:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:19:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 513, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.248.221.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:56:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:56:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.154.40.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:58:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:21:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 45266, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.195.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:58:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:58:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.138.197.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T01:58:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:00:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.102.61.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:00:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:44:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.102.61.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:00:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:12:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 398084, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.39.22.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:02:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:52:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.97.210.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:06:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:53:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 67445, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.82.138.44", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:10:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:08:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2694491, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.218.206.112", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T02:10:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:06:44Z" }, "ports": [ 69, 0, 177 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 4447, "tags": [ "udp", "tftp", "icmp", "xdmcp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "147.203.255.20", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-23T02:10:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:04:08Z" }, "ports": [ 161, 0, 1900, 53, 111 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-SNMP public access udp" ], "sightings": 565475, "tags": [ "udp", "snmp", "icmp", "sunrpc", "portmapper" ], "rule_count": 7, "classification_count": 4 }, { "ioc": "220.71.115.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:10:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:11:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.47.209.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:11:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:19:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1236, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.27.30.167", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:12:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:12:33Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 78, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "144.126.131.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:12:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:56:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10323, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.162.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:13:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:28:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 30", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 7915, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "64.62.197.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:13:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:42:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3368, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.144.21.56", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T02:15:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:01:52Z" }, "ports": [ 0, 22, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 47972, "tags": [ "icmp", "tcp", "ssh", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "205.210.31.13", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-23T02:16:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:21:53Z" }, "ports": [ 0, 80, 1900, 22, 53, 1434, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 123089, "tags": [ "icmp", "alert", "tcp", "http", "udp", "ssh", "ZGrab", "snmp" ], "rule_count": 11, "classification_count": 4 }, { "ioc": "103.229.42.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:17:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:20:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 638, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.214.232.234", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:18:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:53:24Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 312, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.93.16.74", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:18:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:53:06Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 43505, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "66.240.236.116", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-23T02:19:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:40:37Z" }, "ports": [ 161, 0, 22, 80 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "ET CINS Active Threat Intelligence Poor Reputation IP group 68", "ET 3CORESec Poor Reputation IP group 42", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 70714, "tags": [ "udp", "snmp", "icmp", "alert", "tcp", "ssh", "http", "Go" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "209.145.52.195", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:21:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:05:54Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 156, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:24:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:55:55Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 4290, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "39.107.233.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:26:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:26:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.232.27", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:31:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:56:11Z" }, "ports": [ 161, 0, 80 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 73" ], "sightings": 55919, "tags": [ "udp", "snmp", "icmp", "alert", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "143.198.177.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:31:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T08:45:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.83.146.70", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-01-23T02:31:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:28:01Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 8058, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.185.116.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:39:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:09:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 684502, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.247.31.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:39:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:40:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.232.28", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:40:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:13:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 910, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "95.94.118.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:43:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.102.61.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:46:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:19:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 138205, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.144.87.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:47:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:29:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 638, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.164.246.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:50:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:32:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.106.195.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:51:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:52:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.133.97.104", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:52:31Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:54:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:36:06Z" }, "ports": [ 0, 22, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "(stream_tcp) data on SYN packet" ], "sightings": 11979, "tags": [ "icmp", "alert", "tcp", "ssh", "http" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "37.49.230.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:55:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:55:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.104.177.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:55:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:56:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.33", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:58:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:17:56Z" }, "ports": [ 0, 22, 1900, 80, 53, 5632 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15093, "tags": [ "icmp", "alert", "tcp", "ssh", "udp", "http" ], "rule_count": 7, "classification_count": 4 }, { "ioc": "185.236.228.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:58:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:17:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.236.0.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:58:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:59:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.86.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T02:59:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:59:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.102.61.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:01:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:02:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 612843, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.96", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T03:01:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:38:42Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 7759, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.208.106", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T03:05:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:22:16Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 4200, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "80.66.77.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:54:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 618, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.240.23.237", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:08:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:29:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 110470, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.33.239.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:09:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:09:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:09:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:03:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6498, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.231.186", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:12:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:12:51Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 78, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "92.222.120.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:14:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:31:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.182.16.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:16:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:03:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.167.205.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:17:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:17:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.250.119", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:18:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:12:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 46395, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "222.114.107.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:18:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:10:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1623, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.20", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan", "Executable code was detected", "Information Leak" ], "first_seen": { "$date": "2023-01-23T03:20:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:26:23Z" }, "ports": [ 0, 161, 1900, 80, 22, 1434, 53, 5632 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response" ], "sightings": 50269, "tags": [ "icmp", "udp", "snmp", "alert", "tcp", "http", "ssh" ], "rule_count": 13, "classification_count": 5 }, { "ioc": "59.55.128.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:20:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:59:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10358, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:24:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:47:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12184, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.246.95.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:24:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:50:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.37.255.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:27:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:16:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19242, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.196.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:27:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:40:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13020, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:23:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16732, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.130", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-23T03:31:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:47:22Z" }, "ports": [ 53, 0, 1434, 5632 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "APP-DETECT PCAnywhere server response" ], "sightings": 36850, "tags": [ "udp", "icmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "95.244.99.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:32:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:33:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.135", "classifications": [ "Misc activity", "Information Leak", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:33:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:53:18Z" }, "ports": [ 5632, 0, 22, 161, 53 ], "reporting_nodes": 3, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt" ], "sightings": 25309, "tags": [ "udp", "icmp", "alert", "tcp", "ssh", "snmp" ], "rule_count": 11, "classification_count": 4 }, { "ioc": "45.150.243.128", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T03:33:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:34:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 107398, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.142.125.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:35:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:54:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46887, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.8.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:20:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.38.196.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:35:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:36:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.35", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:36:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:49:56Z" }, "ports": [ 161, 0, 53, 1434, 22 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "SQL ping attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51961, "tags": [ "udp", "snmp", "icmp", "tcp", "ssh" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "107.170.224.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:38:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:38:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.249.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:39:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:52:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6726, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.33", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T03:42:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:37:12Z" }, "ports": [ 0, 22, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 17719, "tags": [ "icmp", "alert", "tcp", "ssh", "Go", "udp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "205.185.124.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T19:15:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1484, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.149.241.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:43:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.6.160.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:44:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:27:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1406, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.232.21.75", "classifications": [ "Detection of a Network Scan", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-23T03:45:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:46:48Z" }, "ports": [ 1900, 0, 1434, 111 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 45891, "tags": [ "udp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "138.128.240.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:45:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:42:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 316, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.79.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:46:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:03:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:48:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:29:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11627, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.31.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:51:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:51:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 30" ], "sightings": 65, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.227.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:47:55Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1276, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "184.105.139.107", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T03:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:03:14Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 2680, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.129", "classifications": [ "Misc activity", "Detection of a Network Scan", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:51:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:38:54Z" }, "ports": [ 0, 5632, 1900, 22, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET DROP Dshield Block Listed Source group 1", "ET 3CORESec Poor Reputation IP group 27", "SQL ping attempt" ], "sightings": 44623, "tags": [ "icmp", "udp", "tcp", "ssh", "alert" ], "rule_count": 11, "classification_count": 4 }, { "ioc": "162.142.125.227", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:52:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:52:43Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 78, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "91.189.91.39", "classifications": [], "first_seen": { "$date": "2023-01-23T03:52:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:52:26Z" }, "ports": [ 57450, 56088, 45778 ], "reporting_nodes": 2, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 1150, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.210.51", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-23T03:54:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:09:05Z" }, "ports": [ 5060, 0, 111 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 7608, "tags": [ "udp", "icmp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "94.102.61.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T03:57:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:44:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41613, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.18.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T03:59:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:01:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:01:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:30:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2612, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.116.14.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:02:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:44:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 98000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.31.159.65", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T04:02:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:45:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 34630, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.52", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:03:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:07:31Z" }, "ports": [ 111, 0, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 25081, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:03:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:52:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 642, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.22", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-23T04:05:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:33:26Z" }, "ports": [ 0, 22, 5632, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "APP-DETECT PCAnywhere server response", "PROTOCOL-DNS named version attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 41791, "tags": [ "icmp", "alert", "tcp", "ssh", "udp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "118.195.250.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:07:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:07:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.141.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:07:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:46:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32099, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.34.178.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:09:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:10:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.91", "classifications": [ "Misc activity", "Decode of an RPC Query", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T04:09:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:38:20Z" }, "ports": [ 0, 111, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 13996, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "144.217.201.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:10:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:09:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.228.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:10:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:28:18Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 7624, "tags": [ "icmp", "alert", "tcp", "ssh", "anomaly" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "37.120.148.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:12:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:57:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2832, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.226.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:51:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.235.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:20:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:34:58Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 938, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.68.208.20", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T04:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:35:28Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 5359, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "152.32.172.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:22:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:22:41Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) method is unknown" ], "sightings": 130, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "78.187.37.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:23:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:23:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.156.154.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:23:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T12:35:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 840, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.54", "classifications": [ "Misc activity", "Detection of a Network Scan", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T04:24:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:31:03Z" }, "ports": [ 0, 1900, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-TFTP Get" ], "sightings": 102411, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "59.126.178.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:24:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:25:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.82.197.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:25:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:25:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 29" ], "sightings": 53, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.149.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:29:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:21:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6810, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.99.93.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:32:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:33:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:35:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:33:37Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 5366, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "80.14.45.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:37:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:28:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 562, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.40.18.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:40:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:03:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1056, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.17.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:41:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:41:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.85.199.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:41:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:20:46Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 65" ], "sightings": 4674, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "216.218.206.80", "classifications": [ "Misc activity", "Potentially Bad Traffic", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T04:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:09:21Z" }, "ports": [ 0, 69, 1900, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "INDICATOR-SCAN UPnP service discover attempt", "SQL ping attempt" ], "sightings": 18587, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.51", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:46:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:58:19Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22204, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "219.111.2.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:46:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:47:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.4.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:48:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:49:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:51:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:44:13Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 6253, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "98.5.29.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:51:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:51:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.111", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T04:51:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:10:58Z" }, "ports": [ 0, 177, 1900, 80, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "INDICATOR-SCAN UPnP service discover attempt", "(stream_tcp) data on SYN packet", "SQL ping attempt" ], "sightings": 25888, "tags": [ "icmp", "udp", "xdmcp", "tcp", "http" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "220.89.58.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:00:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:00:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.20.86.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:00:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:01:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.231.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:02:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:02:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.3.118.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:02:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:50:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1050, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:02:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:55:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6812, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.222.178.230", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T05:02:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:16:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 62170, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "114.221.192.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:03:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:03:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.238.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:03:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:03:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.107.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:04:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:23:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 990, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.161", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T05:07:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:05:23Z" }, "ports": [ 0, 161, 53, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response" ], "sightings": 28688, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "192.241.225.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:11:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:03:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22980, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.15", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T05:11:32Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:01:31Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 10815, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "173.182.83.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:12:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:13:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.142.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:13:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:29:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.214.134.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:13:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:10:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 143793, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.134.144.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:59:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.79.201.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:15:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:15:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.39.46.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:15:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.124", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T05:15:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:54:09Z" }, "ports": [ 0, 1900, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 20711, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "220.94.9.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:16:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:12:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2048, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.12", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:20:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:37:08Z" }, "ports": [ 0, 53, 1434, 161, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24034, "tags": [ "icmp", "udp", "snmp", "tcp", "ssh" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "37.157.254.64", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:22:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:42:03Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 156, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.247.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:25:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:57:06Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26528, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "170.238.160.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:25:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:40:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13880, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.90.122.210", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:26:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:46:16Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 156, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "141.94.202.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:28:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:28:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.15.179.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:30:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:30:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.185.72.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:30:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:30:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.19.3.141", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:32:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:55:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 105812, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.143.109.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:34:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:19:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.123", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T05:35:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:12:10Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 7539, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "36.255.54.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:35:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:36:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.155.42.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:38:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:38:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.9.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:38:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:40:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.44.186.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:43:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:44:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.123", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T05:44:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:21:19Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 15883, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "97.87.248.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T05:46:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:46:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.211.9", "classifications": [], "first_seen": { "$date": "2023-01-23T05:46:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:26:16Z" }, "ports": [ 3389, 995, 8080, 8081, 8083, 5001, 9000, 8443, 7443, 8888 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 27299, "tags": [ "tcp", "rdp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "58.95.178.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:48:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:02:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 586, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.232.150.247", "classifications": [], "first_seen": { "$date": "2023-01-23T05:52:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:59:04Z" }, "ports": [ 60370, 49260, 47618, 55074 ], "reporting_nodes": 2, "rules": [ "(http_inspect) HTTP Content-Length message body was truncated", "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management" ], "sightings": 3505, "tags": [ "tcp", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "184.105.139.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:55:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:53:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7146, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "110.23.127.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:56:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.103.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:57:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:30:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29170, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.235.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T05:58:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:01:26Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 5620, "tags": [ "icmp", "alert", "tcp", "ssh", "anomaly" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "94.23.251.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:25:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29445, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.35", "classifications": [ "Attempted Information Leak", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-23T06:01:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:45:50Z" }, "ports": [ 161, 0, 80, 111 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 12243, "tags": [ "udp", "snmp", "icmp", "alert", "tcp", "http", "sunrpc", "portmapper" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "123.204.229.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:05:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:05:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.44.247.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:07:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:07:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.82.127.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:12:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:25:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 124, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.85.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:14:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:14:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.194.31", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T06:15:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:32:59Z" }, "ports": [ 0, 162 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 1003, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.235.24.26", "classifications": [ "Misc activity", "Executable code was detected", "Information Leak", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T06:16:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:46:08Z" }, "ports": [ 5632, 0, 22, 53, 1900, 161 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 71504, "tags": [ "udp", "icmp", "tcp", "ssh", "snmp" ], "rule_count": 11, "classification_count": 5 }, { "ioc": "162.142.125.181", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:18:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:35:51Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50901, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.244.198.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:18:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:48:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.81.122.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:20:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:41:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60819, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.33.46.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:24:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:59:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited" ], "sightings": 75470, "tags": [ "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.241.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:24:57Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:18:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4318, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.98.181.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:27:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:29:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17011, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.92.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:28:00Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:20:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.230.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:29:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:03:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.213.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:30:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:30:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.152.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:33:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:44:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 54", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 700, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "64.62.197.38", "classifications": [ "Attempted Information Leak", "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T06:35:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:05:08Z" }, "ports": [ 161, 0, 80, 69, 1434 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-TFTP Get", "SQL ping attempt" ], "sightings": 28911, "tags": [ "udp", "snmp", "icmp", "alert", "tcp", "http", "tftp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "14.49.113.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:36:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:37:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.110", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T06:37:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:45:50Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 20167, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "194.110.115.99", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T06:39:08Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:57:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 32801, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "92.63.196.134", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T06:39:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:32:20Z" }, "ports": [ 794, 161, 455, 705, 162, 830, 945, 449, 56328, 2027 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP AgentX/tcp request", "PROTOCOL-SNMP trap tcp" ], "sightings": 4838, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "178.79.171.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:42:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:08:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.89.84.42", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:47:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:34:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12245, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.33.187.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:48:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:48:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.47.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:50:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:51:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.237.145.167", "classifications": [], "first_seen": { "$date": "2023-01-23T06:51:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:26:45Z" }, "ports": [ 6443, 9000, 8888, 9443, 4443, 8080, 8008, 3389, 3306, 58603, 993, 8443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 20261, "tags": [ "tcp", "http", "rdp", "mysql" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.162.88.101", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:52:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:53:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 75773, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.45.183.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:53:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:54:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:55:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:42:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6134, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.95.146.204", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T06:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:23:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 56793, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.34", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:58:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:11:04Z" }, "ports": [ 0, 53, 1900, 5632, 80, 22, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "APP-DETECT PCAnywhere server response", "ET 3CORESec Poor Reputation IP group 25", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt" ], "sightings": 51898, "tags": [ "icmp", "udp", "alert", "tcp", "http", "ssh" ], "rule_count": 11, "classification_count": 5 }, { "ioc": "121.155.171.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T06:59:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:01:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:03:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:03:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.251.176.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:05:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:38:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.218.173", "classifications": [], "first_seen": { "$date": "2023-01-23T07:06:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:18:37Z" }, "ports": [ 8443, 4433 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 264, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.177.246.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:10:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:52:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29165, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.104.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:12:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:13:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.49.237.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:14:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:56:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.116.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:18:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:29:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.240.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:18:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:02:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2228, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.1.106.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:19:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:20:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.101.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:21:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:43:40Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 11684, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.95.75.94", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T07:24:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:16:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 65898, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "85.132.246.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:26:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:33:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:06:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4908, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.118", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T07:37:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:46:15Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 1439, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "15.204.158.46", "classifications": [], "first_seen": { "$date": "2023-01-23T07:37:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:37:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.139.57.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:37:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:00:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 694, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.72", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T07:37:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:55:28Z" }, "ports": [ 0, 177, 69, 1434, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "PROTOCOL-TFTP Get", "SQL ping attempt", "(stream_tcp) reset outside window" ], "sightings": 28857, "tags": [ "icmp", "udp", "xdmcp", "tftp", "tcp", "http" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "220.77.57.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:37:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:45:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 507, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "226.77.126.174", "classifications": [], "first_seen": { "$date": "2023-01-23T07:39:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:39:51Z" }, "ports": [ 60902 ], "reporting_nodes": 1, "rules": [ "(ipv4) IPv4 packet from multicast source address" ], "sightings": 26, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "153.170.137.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:39:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:34:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 7990, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.147.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:39:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:43:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.160.61.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:40:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 130, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "205.210.31.16", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T07:44:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:31:07Z" }, "ports": [ 0, 53, 1900, 161, 80, 22, 5632 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ET DROP Dshield Block Listed Source group 1", "APP-DETECT PCAnywhere server response" ], "sightings": 38020, "tags": [ "icmp", "udp", "snmp", "alert", "tcp", "http", "ssh" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "162.142.125.132", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T07:45:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:48:36Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 17158, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.121.171.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:45:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:26:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25636, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.74.6.228", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T07:50:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:11:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4345, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "79.11.109.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:51:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:51:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.237.172.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:52:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:54:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.106.13.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T07:58:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:35:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 898, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.68.125.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:26:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15696, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.75.47.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:04:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:48:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 1986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.188.210.109", "classifications": [], "first_seen": { "$date": "2023-01-23T08:04:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:29:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 341563, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "220.133.218.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:05:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:06:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.177", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T08:09:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:15:34Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 76020, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.22", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:09:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:41:05Z" }, "ports": [ 0, 53, 1434, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "SQL ping attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23825, "tags": [ "icmp", "udp", "tcp", "ssh" ], "rule_count": 8, "classification_count": 4 }, { "ioc": "146.190.144.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:09:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:14:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 728, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.70.225.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:11:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:12:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.55.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:15:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:01:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8114, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.148.10.241", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T08:22:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:36:12Z" }, "ports": [ 0, 161, 69, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "INDICATOR-SCAN UPnP service discover attempt", "(icmp4) ICMP ping Nmap", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 421532, "tags": [ "icmp", "udp", "snmp", "tftp" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "144.217.84.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:26:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:07:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18970, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.91.182.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:27:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:21:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.248.242.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:28:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:27:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4755, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:28:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:25:27Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 3161, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:33:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:21:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48398, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.177.69.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:34:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:35:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.234.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:36:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.164.148.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:39:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:39:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.127.225.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:39:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.101.73.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:39:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:40:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.16.16.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:41:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:42:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.89.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:46:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:04:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3692, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.225.69", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:46:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:23:13Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 156, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "139.162.252.121", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:48:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:40:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 83721, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.132.109.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:51:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:07:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.164.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:54:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:54:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.34.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T08:58:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:23:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 206, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.91.8.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:59:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:59:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.218.96.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:00:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:01:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.24", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T09:00:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:35:25Z" }, "ports": [ 0, 1434, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "X11 xdmcp info query" ], "sightings": 76380, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.35.20.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:01:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:01:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.123.211.81", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:05:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:54:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 59980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "65.49.20.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:08:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:55:43Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 7117, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "172.104.127.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:12:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:26:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.130.10.173", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T09:12:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:47:05Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 71688, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "175.203.155.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:15:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:16:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:07:17Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 4982, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.2", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T09:20:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:44:32Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 4126, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "184.105.139.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:23:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:52:22Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9622, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "94.102.61.30", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T09:24:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:44:23Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 762745, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.255.168.152", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:26:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:00:32Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 45" ], "sightings": 50681, "tags": [ "icmp", "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "184.105.139.75", "classifications": [ "Misc activity", "Decode of an RPC Query", "Detection of a Network Scan", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T09:26:37Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:13:35Z" }, "ports": [ 0, 111, 1900, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-TFTP Get" ], "sightings": 6201, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "tftp" ], "rule_count": 5, "classification_count": 4 }, { "ioc": "121.135.63.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:40:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3804, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.240.10", "classifications": [ "Attempted Information Leak", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-23T09:28:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:00:01Z" }, "ports": [ 161, 0, 111 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 1493, "tags": [ "udp", "snmp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "192.241.227.25", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:28:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:28:42Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "126.4.122.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:30:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:36:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2124, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.23.71.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:32:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:06:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 57" ], "sightings": 1690, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "189.54.8.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:33:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:34:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.241.103.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:34:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:35:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.100.254.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:36:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:13:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 708, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "131.159.25.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:36:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T23:43:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40197, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:37:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:52:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3384, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:37:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:23:50Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 69, "tags": [ "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "45.136.59.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:47:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:19:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1830, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.219.238.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:48:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:48:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.17.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:51:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:13:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1056, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.2.177.109", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:51:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:00:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8545, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "87.2.183.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:53:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:04:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 474, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.125.66.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:54:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.94.202.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:57:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:15:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2500, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.32.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T09:58:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:58:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.91.35.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T09:59:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:59:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.153.180.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:01:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:01:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.29.70.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:03:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:09:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:05:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:00:48Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 10052, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "101.39.241.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:09:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:09:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.10", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:11:55Z" }, "ports": [ 1900, 0, 80 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 9464, "tags": [ "udp", "icmp", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.234.217.254", "classifications": [], "first_seen": { "$date": "2023-01-23T10:10:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:10:59Z" }, "ports": [ 33782 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 26, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.189.72.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:10:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:48:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 93665, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "79.137.34.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:10:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:07:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 99266, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.242.10", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:17:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T12:18:24Z" }, "ports": [ 162, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6652, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "183.107.82.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:18:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:18:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:18:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:50:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.239.10", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:30:05Z" }, "ports": [ 162, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1234, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "175.215.71.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:20:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.133.233.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:22:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:22:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "73.112.30.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:24:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:25:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:25:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:00:25Z" }, "ports": [ 80, 0 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12636, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.136.155.39", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:25:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:53:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 148999, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.9", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:29:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:54:05Z" }, "ports": [ 1900, 0, 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 9166, "tags": [ "udp", "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "131.159.25.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:28:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38761, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.189.7.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:31:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:33:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.225.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:35:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:01:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 86, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.214.74.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:35:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:10:12Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 107596, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "100.37.46.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:36:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:44:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 303, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.85.7.129", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:37:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:52:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 52452, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.33.240.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:39:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:26:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 840, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.104.26", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-23T10:41:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:44:09Z" }, "ports": [ 0, 111 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 1153, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "196.218.238.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:49:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:50:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 208, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.234.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:51:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.118.123.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:53:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:54:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.8.81", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T10:53:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:04:58Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 208, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.82.47.7", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T10:53:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:11:31Z" }, "ports": [ 177, 0, 1900, 80, 1434 ], "reporting_nodes": 3, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "SQL ping attempt" ], "sightings": 6389, "tags": [ "udp", "xdmcp", "icmp", "alert", "tcp", "http" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "54.180.102.1", "classifications": [], "first_seen": { "$date": "2023-01-23T10:55:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:55:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "74.82.47.53", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T10:56:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T11:21:29Z" }, "ports": [ 0, 177, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 15728, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "54.198.55.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T10:59:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T10:59:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.104.52.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:00:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:25:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 76, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.195.253.86", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:03:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:09:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 175351, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.125.190.57", "classifications": [], "first_seen": { "$date": "2023-01-23T11:04:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:56:06Z" }, "ports": [ 33737, 33205, 33433, 52035, 59248, 60257, 38268, 54027, 54019, 50261, 44358, 36427, 51362, 37037, 60415, 35688, 54283 ], "reporting_nodes": 2, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 6360, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.228.31.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:04:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:04:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.35", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:58:23Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14972, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "114.35.59.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:09:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:11:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:13:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:47:25Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 12310, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "121.146.113.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:13:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:13:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.240.236.109", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T11:14:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:42:18Z" }, "ports": [ 0, 80, 161, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "ET CINS Active Threat Intelligence Poor Reputation IP group 68", "ET 3CORESec Poor Reputation IP group 42", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 57862, "tags": [ "icmp", "alert", "tcp", "http", "udp", "snmp", "ssh", "Go" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "98.143.218.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:16:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:16:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.186.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:16:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:24:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3318, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.151.22.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:18:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:22:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 146668, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.40.11.108", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:18:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:48:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60637, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.241.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:19:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:19:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.130.225.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:19:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:54:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1382, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.101.148.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:23:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:25:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.175.88.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:28:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:14:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.61.219.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:28:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:33:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.214.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:31:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:19:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 892, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.229.67.9", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:31:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:30:15Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1214, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "71.6.158.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:33:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:46:35Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 72" ], "sightings": 9738, "tags": [ "icmp", "alert", "tcp", "ssh", "paramiko_2.11.0" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "203.67.60.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:34:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:10:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1216, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "156.251.176.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:35:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:07:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3891, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.150.167", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T11:43:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:43:10Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 26, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.89.115.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:44:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:42:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 126290, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.227.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:45:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:12:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13612, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:46:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:54:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.221.185.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:54:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:55:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.104.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:57:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:28:39Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 3012, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "118.47.181.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:58:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:13:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5396, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.242.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T11:59:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T23:56:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2926, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.150.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:59:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:07:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 764, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.95.227.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:02:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:02:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.214.156.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:03:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:59:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1340, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.104.220.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:05:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:37:55Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23090, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.214.132.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:08:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:31:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.151.24", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T12:11:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:05:44Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 14429, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.142.125.178", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T12:13:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:57:55Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 103281, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.126.18.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:14:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:15:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.154.231.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:15:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:51:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 308482, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:18:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:33:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5442, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:21:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:21:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11787, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.208.6", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T12:21:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:11:14Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 608, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "216.98.90.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:23:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:23:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.236.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:40:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10788, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.153.33.167", "classifications": [], "first_seen": { "$date": "2023-01-23T12:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:12:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 104, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.23.31.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:25:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:25:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.225.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:25:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:19:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 51" ], "sightings": 1252, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "92.158.71.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:27:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:27:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.208.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:28:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:29:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.100.103.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:28:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:29:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:29:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:18:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10633, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:31:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:57:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.185", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T12:33:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:51:23Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 42367, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.35.18.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:35:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:12:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.163.95.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:35:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:36:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.9", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:38:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:40:06Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14613, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.137.4", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:40:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:32:52Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3982, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "27.32.171.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:44:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:46:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.108", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T12:47:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:54:58Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 20633, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.230.9", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:47:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:32:46Z" }, "ports": [ 161, 0, 53 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 2218, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.227.84.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:49:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:33:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 73301, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.112.107", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:49:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:08:52Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 616, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.149.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:49:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:35:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.229.33.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:49:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:37:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 70, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.92.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:56:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T12:56:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.242.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T12:56:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:06:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14981, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.123.88.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:01:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.145.220.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:02:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:13:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 31" ], "sightings": 665, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "220.132.92.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:02:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:51:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.99", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T13:06:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:56:08Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 44489, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.142.15", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T13:08:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:08:40Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 1782, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.229.55.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:08:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:09:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.114.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:09:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:46:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1110, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.143.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:14:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:29:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 692, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.19.96.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:16:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.114.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:16:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.13.56.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:17:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:17:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.87.173.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:20:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:15:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50122, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.235.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:22:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:45:32Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA Applayer Detect protocol only one direction" ], "sightings": 2199, "tags": [ "icmp", "alert", "tcp", "ssh", "anomaly" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "120.34.146.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:22:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:22:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.230.16", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T13:23:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:13:32Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 8458, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "150.109.184.191", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:23:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:43:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50912, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "49.213.219.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:24:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:24:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.205.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:29:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:29:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.230.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:29:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:29:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.38.80.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:36:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.172.248.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:40:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:55:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 61988, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.182.132.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:44:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:32:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18841, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.165.205.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:46:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:38:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1214, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.222.200.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:48:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:49:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.168.16.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:49:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:50:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.186.170.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:51:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:02:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.167.97.31", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T13:53:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:15:32Z" }, "ports": [ 161, 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 782, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.80.142.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:54:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:55:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:56:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:45:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.56.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T13:58:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:59:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.230.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T13:58:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T13:58:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.208.22", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T14:01:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:30:29Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 12939, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.246.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:02:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:01:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3218, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.219.59.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:05:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:05:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.254.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:06:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.138.27.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:08:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:08:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.223.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:08:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T01:45:29Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 4836, "tags": [ "icmp", "alert", "tcp", "ssh", "anomaly" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "162.243.151.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:10:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:46:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10142, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.177.53.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:12:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:13:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.4.117.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:12:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:33:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17966, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.207.247.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:12:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:14:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:13:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:56:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1342, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:15:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:50:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2756, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:20:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:17:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.209.23.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:20:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.255.176.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:24:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:25:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.32.106.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:28:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:29:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.46.82.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:31:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:32:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.176.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:34:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:39:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.32.152.253", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:39:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:08:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 59379, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "106.104.116.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:42:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:08:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1274, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "24.25.255.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:42:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:01:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 933, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.134.185.89", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T14:42:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:24:28Z" }, "ports": [ 0, 177, 161, 53, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 41264, "tags": [ "icmp", "udp", "xdmcp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "103.44.253.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:45:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:37:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 34916, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.193.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:47:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:36:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1098, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.140.56.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:48:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:48:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.208.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:50:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:23:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23934, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.115.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:52:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:14:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9856, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.239.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:55:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:59:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.250.206.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T14:59:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:39:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 77145, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.43.123.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:04:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:04:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.28.117.124", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T15:05:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:40:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 156296, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "192.241.227.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:05:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:05:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.176", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T15:05:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:55:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 68338, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "116.33.248.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T15:06:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:07:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.223.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T15:09:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:10:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:12:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:44:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32862, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.136", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T15:14:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:39:01Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 43254, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.129.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:18:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:54:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3880, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.183.62.133", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T15:20:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:40:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 55166, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:21:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:14:14Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2810, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.142.125.184", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T15:22:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:08:51Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 48599, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.44.238.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:26:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:31:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.208.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:26:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:05:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.39.61.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:28:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:15:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2642, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.112.161", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T15:32:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:51:07Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 3964, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "61.72.194.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T15:33:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:35:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.207.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:34:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:37:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 58, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.228.32.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T15:36:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:37:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.132.92.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:40:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:04:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 57828, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.238.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T15:45:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:45:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:47:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:49:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 68, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.123.105.90", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T15:49:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:46:35Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 93114, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "41.46.72.1", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:58:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:58:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:58:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:23:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14946, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T15:58:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:24:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6258, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:02:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:32:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.17.67", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T16:04:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:39:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 119740, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "111.185.238.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T16:07:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:08:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.205.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:14:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:25:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11133, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:15:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:16:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15631, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "208.115.216.193", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:16:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:19:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 90819, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "120.79.24.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:19:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:44:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 58, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.193.159.2", "classifications": [], "first_seen": { "$date": "2023-01-23T16:23:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:24:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 96971, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "178.79.171.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:25:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:41:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.95.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:32:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:31:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4428, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.120.48.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T16:32:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:46:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 578, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:33:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:37:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3882, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.138.215.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:34:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:34:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.81.94.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:36:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.107.217.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T16:38:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:39:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.55.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T16:39:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:41:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.182.138.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:41:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.239.0.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:42:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.22.141.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T16:44:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:44:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.44.49.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T16:45:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:46:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:52:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:52:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3492, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.35.18.225", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T16:53:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:53:14Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 26, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.117.130.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T16:56:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:24:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.208.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:56:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:20:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1622, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.60.119.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:44:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.126.83.129", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T17:03:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:53:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 73981, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "66.36.234.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:05:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:47:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "133.175.22.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:09:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:10:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.112.5.140", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T17:12:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:42:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 114421, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "89.248.163.191", "classifications": [], "first_seen": { "$date": "2023-01-23T17:14:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:53:56Z" }, "ports": [ 7500, 1077, 4405, 1400 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 64, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.229.100.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:14:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:15:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.144.20", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T17:16:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:29:17Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 14599, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.139.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:56:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25094, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.188.33.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:20:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:20:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.183.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:22:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:27:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13892, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.95.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:25:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:25:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.114.50.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:26:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:30:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 96282, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.173.165.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:26:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:28:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.133.174.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:28:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:29:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.34", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-23T17:29:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:47:19Z" }, "ports": [ 161, 0, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "SQL ping attempt" ], "sightings": 20475, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "119.188.182.154", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:31:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:03:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 94090, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "123.58.199.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:31:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.39.227.251", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:31:26Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:14:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 59217, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.186", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T17:33:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:39:43Z" }, "ports": [ 161, 0, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 11119, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "59.16.114.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:34:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T14:42:13Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 56" ], "sightings": 6438, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "114.33.71.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:34:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:29:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 5", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 2972, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "112.120.68.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:41:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:41:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "166.111.130.172", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:41:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:09:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17353, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.120.48.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:46:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:16:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 702, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.40.118.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T17:48:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:48:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "148.70.247.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:52:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:07:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 75600, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.171.217.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:52:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:06:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 614, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.131.71.130", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:54:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:50:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 95214, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.47.61.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:56:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:27:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1768, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T17:56:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:58:46Z" }, "ports": [ 0, 80 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 689, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.130.11.228", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-23T17:58:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:31:54Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP Get" ], "sightings": 50427, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.32.51.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:00:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:00:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.125.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:02:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:02:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.196.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:02:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:04:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 31" ], "sightings": 62, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.181.164.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:08:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:01:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:09:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:03:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 890, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.149.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:10:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:11:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.240.205.34", "classifications": [ "A Network Trojan was detected", "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:11:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:49:00Z" }, "ports": [ 16464, 0, 80 ], "reporting_nodes": 3, "rules": [ "MALWARE-CNC Win.Trojan.ZeroAccess inbound connection", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 68" ], "sightings": 17981, "tags": [ "udp", "icmp", "alert", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.232.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:13:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:13:41Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 78, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.100.111", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T18:14:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:26:54Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 2568, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "162.142.125.136", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:14:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:33:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24032, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "206.189.92.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:14:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:22:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 718, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.234.52.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:16:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:45:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 240, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.247.14.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:18:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:40:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.128.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:19:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:10:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 49" ], "sightings": 474, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "2600:9000:24f4:5000:0018:30b3:e400:93a1", "classifications": [], "first_seen": { "$date": "2023-01-23T00:53:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T00:53:36Z" }, "ports": [ 53154 ], "reporting_nodes": 1, "rules": [ "GPL ATTACK_RESPONSE id check returned root" ], "sightings": 19, "tags": [ "alert", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.136.225.32", "classifications": [], "first_seen": { "$date": "2023-01-23T01:05:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T10:58:40Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 21" ], "sightings": 7012, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "60.250.70.178", "classifications": [], "first_seen": { "$date": "2023-01-23T01:09:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:09:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 61", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.211.4", "classifications": [], "first_seen": { "$date": "2023-01-23T01:23:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T01:23:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.142.146.214", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:37:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:47:16Z" }, "ports": [ 80, 53, 0 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18993, "tags": [ "alert", "tcp", "http", "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "179.43.177.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T01:57:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:13:57Z" }, "ports": [ 80, 0 ], "reporting_nodes": 3, "rules": [ "ET 3CORESec Poor Reputation IP group 20", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18610, "tags": [ "alert", "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "125.228.35.198", "classifications": [], "first_seen": { "$date": "2023-01-23T02:00:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:00:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.224.128.230", "classifications": [], "first_seen": { "$date": "2023-01-23T02:00:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:11:35Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 73, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.180", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-23T02:07:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:04:30Z" }, "ports": [ 22, 111, 0 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 889, "tags": [ "alert", "tcp", "ssh", "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.168", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T02:09:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:14:52Z" }, "ports": [ 22, 0, 177, 1434 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "SQL ping attempt" ], "sightings": 24473, "tags": [ "alert", "tcp", "ssh", "icmp", "udp", "xdmcp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "193.163.125.61", "classifications": [], "first_seen": { "$date": "2023-01-23T02:10:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T02:10:49Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 19, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "73.61.120.226", "classifications": [], "first_seen": { "$date": "2023-01-23T02:19:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:05:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 74" ], "sightings": 21, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "85.239.33.138", "classifications": [], "first_seen": { "$date": "2023-01-23T02:36:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T19:29:30Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 83" ], "sightings": 847, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "205.185.118.237", "classifications": [], "first_seen": { "$date": "2023-01-23T03:20:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:24:29Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 27" ], "sightings": 70, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "98.235.18.164", "classifications": [], "first_seen": { "$date": "2023-01-23T03:43:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:43:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 92" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "1.158.143.229", "classifications": [], "first_seen": { "$date": "2023-01-23T03:44:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:44:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 1" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "99.66.193.229", "classifications": [], "first_seen": { "$date": "2023-01-23T03:50:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T03:50:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 92" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.144.254.162", "classifications": [], "first_seen": { "$date": "2023-01-23T04:15:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T04:15:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 95" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T04:33:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:36:17Z" }, "ports": [ 80, 0, 1434 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 29808, "tags": [ "alert", "tcp", "http", "icmp", "udp" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "222.114.154.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T04:44:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T12:20:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 32", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1807, "tags": [ "alert", "tcp", "ssh", "brute_force", "HELLOWORLD" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "152.32.143.81", "classifications": [], "first_seen": { "$date": "2023-01-23T04:53:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:51:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SSH Login Attempts" ], "sightings": 345, "tags": [ "alert", "tcp", "ssh", "anomaly", "brute_force" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "203.76.241.10", "classifications": [], "first_seen": { "$date": "2023-01-23T05:12:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:04:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 27", "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3009, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "104.7.44.133", "classifications": [], "first_seen": { "$date": "2023-01-23T05:14:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T05:14:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 100" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "71.6.232.20", "classifications": [], "first_seen": { "$date": "2023-01-23T05:37:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:46:13Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 72" ], "sightings": 32, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.177.239.245", "classifications": [], "first_seen": { "$date": "2023-01-23T05:50:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:13:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 8" ], "sightings": 1281, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.229.164.216", "classifications": [], "first_seen": { "$date": "2023-01-23T06:01:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T06:01:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "2600:9000:24f4:8400:0000:df71:8000:93a1", "classifications": [], "first_seen": { "$date": "2023-01-23T06:04:16Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-01-23T06:04:17Z" }, "ports": [ 43954, 43956 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM ESTABLISHED packet out of window", "SURICATA STREAM ESTABLISHED invalid ack", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM FIN invalid ack", "SURICATA STREAM FIN out of window" ], "sightings": 987498, "tags": [ "alert", "tcp" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "2600:9000:24f4:ba00:0000:df71:8000:93a1", "classifications": [], "first_seen": { "$date": "2023-01-23T06:04:40Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-01-23T06:04:41Z" }, "ports": [ 50784 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM ESTABLISHED packet out of window", "SURICATA STREAM ESTABLISHED invalid ack", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM FIN invalid ack", "SURICATA STREAM FIN out of window" ], "sightings": 361567, "tags": [ "alert", "tcp" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "2600:9000:24f4:a400:0000:df71:8000:93a1", "classifications": [], "first_seen": { "$date": "2023-01-23T06:04:41Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-01-23T06:04:43Z" }, "ports": [ 60962, 60960 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM ESTABLISHED packet out of window", "SURICATA STREAM ESTABLISHED invalid ack", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM FIN invalid ack", "SURICATA STREAM FIN out of window" ], "sightings": 1170155, "tags": [ "alert", "tcp" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "3.87.126.146", "classifications": [], "first_seen": { "$date": "2023-01-23T06:05:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:46:32Z" }, "ports": [ 54846, 38974, 35690, 42160 ], "reporting_nodes": 2, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", "(http_inspect) URI has percent-encoding of an unreserved character" ], "sightings": 1723, "tags": [ "alert", "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "172.105.128.13", "classifications": [], "first_seen": { "$date": "2023-01-23T06:21:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:16:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 20, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "73.155.144.179", "classifications": [], "first_seen": { "$date": "2023-01-23T07:01:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:01:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 74" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "92.118.39.82", "classifications": [], "first_seen": { "$date": "2023-01-23T07:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:58:18Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 87", "ET 3CORESec Poor Reputation IP group 46" ], "sightings": 13195, "tags": [ "alert", "tcp", "http" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "100.15.215.175", "classifications": [], "first_seen": { "$date": "2023-01-23T07:41:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:41:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 92" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.248.165.31", "classifications": [], "first_seen": { "$date": "2023-01-23T07:43:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:43:53Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET CINS Active Threat Intelligence Poor Reputation IP group 85" ], "sightings": 32, "tags": [ "alert", "tcp", "http" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "92.68.41.253", "classifications": [], "first_seen": { "$date": "2023-01-23T07:50:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T07:50:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 88" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "222.168.30.19", "classifications": [], "first_seen": { "$date": "2023-01-23T08:15:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:00:46Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan", "(ssh) server version string overflow" ], "sightings": 3787, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "93.51.31.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T08:16:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:11:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 88", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8876, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "69.130.202.174", "classifications": [], "first_seen": { "$date": "2023-01-23T08:37:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T08:37:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 71" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.185.218.79", "classifications": [], "first_seen": { "$date": "2023-01-23T09:20:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T09:20:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 4" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.96.95.21", "classifications": [], "first_seen": { "$date": "2023-01-23T10:41:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:46:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA TCPv4 invalid checksum" ], "sightings": 131, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "59.26.140.17", "classifications": [], "first_seen": { "$date": "2023-01-23T11:26:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T11:26:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 57" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.46.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T11:39:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:11:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 52", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2186, "tags": [ "alert", "tcp", "ssh", "brute_force", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "122.117.90.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T12:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:08:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1020, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "172.105.128.11", "classifications": [], "first_seen": { "$date": "2023-01-23T12:21:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:17:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 5267, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.93.16.71", "classifications": [], "first_seen": { "$date": "2023-01-23T12:30:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:56:54Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 35" ], "sightings": 1549, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "86.49.157.66", "classifications": [], "first_seen": { "$date": "2023-01-23T12:56:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:35:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 84" ], "sightings": 27, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.116.81.92", "classifications": [], "first_seen": { "$date": "2023-01-23T13:04:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:55:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 8" ], "sightings": 764, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "94.102.61.20", "classifications": [], "first_seen": { "$date": "2023-01-23T13:44:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T03:52:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 89" ], "sightings": 1747, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.142.125.210", "classifications": [], "first_seen": { "$date": "2023-01-23T14:07:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:07:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.25.102.99", "classifications": [], "first_seen": { "$date": "2023-01-23T14:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:14:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 6" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "31.220.1.83", "classifications": [], "first_seen": { "$date": "2023-01-23T14:23:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:53:22Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 17" ], "sightings": 1729, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.228.157.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T14:55:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:12:49Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET 3CORESec Poor Reputation IP group 10", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6328, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "104.221.245.104", "classifications": [], "first_seen": { "$date": "2023-01-23T14:56:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T14:56:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction" ], "sightings": 608, "tags": [ "alert", "tcp", "ssh", "anomaly" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "128.106.199.144", "classifications": [], "first_seen": { "$date": "2023-01-23T15:04:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:04:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 11" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.127.23.120", "classifications": [], "first_seen": { "$date": "2023-01-23T15:05:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:05:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 71" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "47.53.76.89", "classifications": [], "first_seen": { "$date": "2023-01-23T15:09:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:09:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 38" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.216.97.109", "classifications": [], "first_seen": { "$date": "2023-01-23T15:27:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T15:27:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 62" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.32.162.159", "classifications": [], "first_seen": { "$date": "2023-01-23T16:03:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:49:36Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 24" ], "sightings": 23417, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "106.13.29.110", "classifications": [], "first_seen": { "$date": "2023-01-23T16:13:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:07:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 3", "ET SCAN Potential SSH Scan" ], "sightings": 1026, "tags": [ "alert", "tcp", "ssh", "libssh2_1.10.0" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "64.62.197.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T16:35:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:03:14Z" }, "ports": [ 80, 0 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7544, "tags": [ "alert", "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.126.34.158", "classifications": [], "first_seen": { "$date": "2023-01-23T16:46:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:46:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 52" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.237.24", "classifications": [], "first_seen": { "$date": "2023-01-23T16:50:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:50:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.46.195.5", "classifications": [], "first_seen": { "$date": "2023-01-23T16:53:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T16:54:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 32, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "114.35.166.137", "classifications": [], "first_seen": { "$date": "2023-01-23T17:05:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:05:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 6", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 32, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.92.105.11", "classifications": [], "first_seen": { "$date": "2023-01-23T17:26:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T17:26:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 59" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.177.173.45", "classifications": [], "first_seen": { "$date": "2023-01-23T17:38:02Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T04:20:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 62" ], "sightings": 6063, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "93.51.116.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:08:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:14:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 88", "ET 3CORESec Poor Reputation IP group 46", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1218, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "205.210.31.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:09:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:35:44Z" }, "ports": [ 22, 0, 1434 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 9284, "tags": [ "alert", "tcp", "ssh", "icmp", "udp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "66.175.213.4", "classifications": [], "first_seen": { "$date": "2023-01-23T18:16:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:18:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 42", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 37, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "95.255.87.235", "classifications": [], "first_seen": { "$date": "2023-01-23T18:25:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:25:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 90" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.125.202.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:22:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:23:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.130.8", "classifications": [], "first_seen": { "$date": "2023-01-23T18:25:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:05:03Z" }, "ports": [ 8080, 8088, 8443, 58603, 8008, 50001, 3306, 993, 4443, 8081 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 9019, "tags": [ "tcp", "http", "mysql" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.228.35.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:26:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:27:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.76.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:27:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:28:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.67.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:30:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:59:17Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 34", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48508, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "89.248.167.139", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T18:31:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:30:30Z" }, "ports": [ 0, 1900, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 45390, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "185.255.123.224", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T18:34:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 51433, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "160.32.205.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:38:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:38:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "44.193.75.41", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:38:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:01:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 190, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "81.70.198.235", "classifications": [], "first_seen": { "$date": "2023-01-23T18:39:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:17:10Z" }, "ports": [ 21179, 11485, 49648, 27236, 48620, 30141, 7397, 55802, 28636, 54785, 56946, 61864, 65118, 43409, 25946, 16210, 2848, 30268, 51108 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 19851, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.74.78.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:47:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:04:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7446, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.183.233.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:48:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:15:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 80" ], "sightings": 812, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.83.64.1", "classifications": [], "first_seen": { "$date": "2023-01-23T18:50:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:04:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP redirect host", "ICMP Traffic Detected" ], "sightings": 293545, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "220.132.211.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:54:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:14:48Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 11570, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "114.34.49.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T18:55:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:15:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 706, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.131.94.145", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T18:58:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:15:26Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38303, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "74.3.163.37", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T18:58:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:24:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 116284, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "198.235.24.140", "classifications": [ "Misc activity", "Information Leak", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T18:59:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:03:36Z" }, "ports": [ 0, 22, 1434, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 31690, "tags": [ "icmp", "tcp", "ssh", "udp", "snmp", "ZGrab" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "220.133.28.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:02:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:02:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.50.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:02:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:04:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 460, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.246.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:09:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:14:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.30.34.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:15:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:15:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.194.18", "classifications": [], "first_seen": { "$date": "2023-01-23T18:36:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T18:36:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 5", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 30, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "205.210.31.25", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-23T19:04:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:31:09Z" }, "ports": [ 80, 0, 22, 161, 1434 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "SQL ping attempt" ], "sightings": 25072, "tags": [ "alert", "tcp", "http", "icmp", "ssh", "ZGrab", "udp", "snmp" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "220.132.196.67", "classifications": [], "first_seen": { "$date": "2023-01-23T19:05:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:05:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 15, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.35.199.14", "classifications": [], "first_seen": { "$date": "2023-01-23T19:20:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:20:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 6", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 30, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.126.113.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:15:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:17:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.60.217.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:16:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:16:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.34.165.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:19:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:41:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 944, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.183.62.12", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:25:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:27:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60517, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.117.242.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:25:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:04:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 259, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.209.84.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:27:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:24:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54084, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.11.106.182", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:29:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T11:43:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 47530, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "49.213.228.22", "classifications": [], "first_seen": { "$date": "2023-01-23T19:34:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:27:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 41", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 997, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "83.209.50.222", "classifications": [], "first_seen": { "$date": "2023-01-23T19:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:39:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 82" ], "sightings": 14, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "92.40.194.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:34:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:34:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.118.36.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:34:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:36:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.92.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:35:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:35:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.89.63.170", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:39:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:39:31Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 184, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.254.110.231", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:39:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:39:31Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.154.88.182", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T19:41:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:00:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 42015, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "59.27.90.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:42:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:32:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 772, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.131", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T19:42:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:39:25Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 31804, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "31.10.132.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:43:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:43:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.55.146.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:44:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:45:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.229.82.155", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T19:48:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:26:11Z" }, "ports": [ 22, 161 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 82", "PROTOCOL-SNMP request tcp" ], "sightings": 283, "tags": [ "alert", "tcp", "ssh", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.125.188.54", "classifications": [], "first_seen": { "$date": "2023-01-23T19:45:55Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-06-29T21:37:54Z" }, "ports": [ 45166, 40780, 40814, 40990, 45088, 41110, 41124, 41188, 41204, 41282, 41298, 55776, 41364, 41394, 41434, 41470, 41488, 48038, 51554, 38958, 37758, 35802, 56612, 59156, 57102, 43068, 35182, 56656, 33258, 54304, 54276, 47578, 60998, 47398, 55580, 47256, 54754, 56664, 42468, 45898, 34800, 34500, 44286, 54108, 59620, 38150, 39678 ], "reporting_nodes": 3, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 12857, "tags": [ "tcp", "tls" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.92.31.220", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T19:47:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:57:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 119611, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "49.213.234.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:48:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:49:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.209.57.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:49:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:22:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 75268, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.141.151.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:53:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:48:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3840, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:53:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:48:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "208.115.243.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:54:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:49:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8658, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.227.158.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T19:58:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:59:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.202.83.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T19:59:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T19:59:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:06:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T15:52:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3740, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.15", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:09:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:45:36Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2745, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "218.161.87.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:13:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:14:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.209.132.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:15:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:15:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.202.35.43", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:15:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:07:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 84977, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "123.184.59.70", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T20:16:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:58:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 96548, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "192.169.137.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:16:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:16:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "98.143.148.50", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:21:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:22:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 86415, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "95.214.55.85", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T20:24:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:09:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 5670, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "164.52.36.220", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:29:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:18:53Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 840, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "23.30.243.21", "classifications": [], "first_seen": { "$date": "2023-01-23T20:25:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:25:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 13", "ET 3CORESec Poor Reputation IP group 32" ], "sightings": 22, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "220.132.202.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:31:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:32:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.8.60.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:31:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:33:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 78614, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.196.27.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:32:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:21:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46701, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.133", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:35:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:58:08Z" }, "ports": [ 53, 0, 5632, 1900, 161, 1434, 22 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63582, "tags": [ "udp", "icmp", "snmp", "tcp", "ssh" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "106.105.192.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:35:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:36:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.173.64.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:44:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:46:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.236.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:42:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:59:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 486, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.126.113.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:46:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:06:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 48", "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "14.45.0.152", "classifications": [], "first_seen": { "$date": "2023-01-23T20:46:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:46:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 8" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.229.235.101", "classifications": [], "first_seen": { "$date": "2023-01-23T20:54:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:01:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction" ], "sightings": 1069, "tags": [ "alert", "tcp", "ssh", "anomaly" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "45.93.16.37", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-01-23T20:46:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:16:29Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 34289, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "201.26.118.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:51:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:52:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.78.209.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:51:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:51:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.34.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T20:52:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:01:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 790, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.83.172.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:53:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:51:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7632, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:56:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:56:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.52.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T20:58:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T20:58:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.165.152.70", "classifications": [], "first_seen": { "$date": "2023-01-23T20:58:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:00:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "2.7.34.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:00:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:00:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.49", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-23T21:01:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:23:00Z" }, "ports": [ 0, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "APP-DETECT PCAnywhere server response" ], "sightings": 2583, "tags": [ "icmp", "udp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "23.225.180.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:02:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:02:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 85, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "178.42.29.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:02:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:04:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.81.239.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:09:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.160.216.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:09:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:09:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.107.58.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:10:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:10:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.133", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:12:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:37:14Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13984, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.135.246.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:18:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:52:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 732, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.142.125.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:17:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:34:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.1.220.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:17:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:17:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:19:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:20:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8778, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.225.55.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:21:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:21:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.117.5.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:23:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:20:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 560, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.155.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:25:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:27:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.204.85.3", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T21:29:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:57:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 40136, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "178.192.138.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:29:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:31:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "90.151.171.109", "classifications": [], "first_seen": { "$date": "2023-01-23T21:37:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:47:47Z" }, "ports": [ 7890, 15385, 443, 7788, 5678, 3125, 1994, 1981 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 12473, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.162.189.5", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T21:41:33Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:10:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 49157, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "59.15.138.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:43:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:43:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.234.213.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:43:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:15:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 97032, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "76.135.66.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:46:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:47:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.183.44.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:47:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:07:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 8" ], "sightings": 890, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "1.176.186.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:48:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:48:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.36.19.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:48:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:48:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.30.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:50:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:51:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "155.254.192.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:52:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:52:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.105.241.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:54:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:04:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3256, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.70.9.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T21:54:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:49:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 69822, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.37.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:55:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:56:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.209.220.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T21:56:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T21:56:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.144", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T21:56:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:59:55Z" }, "ports": [ 0, 161, 53, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response" ], "sightings": 64162, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "87.98.242.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:02:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:36:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9365, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.107.86.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:06:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:06:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.6.188.169", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:08:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:59:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 59341, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "218.35.169.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:09:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:11:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.30", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:09:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:13:04Z" }, "ports": [ 1900, 0, 53, 161, 1434, 22, 5632 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "APP-DETECT PCAnywhere server response" ], "sightings": 23436, "tags": [ "udp", "icmp", "snmp", "alert", "tcp", "ssh", "ZGrab" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "14.45.5.223", "classifications": [], "first_seen": { "$date": "2023-01-23T22:15:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:15:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 8", "ET 3CORESec Poor Reputation IP group 13" ], "sightings": 8, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "205.210.31.8", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-23T22:15:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:02:50Z" }, "ports": [ 0, 1900, 80, 1434, 161, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "ET DROP Dshield Block Listed Source group 1", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt" ], "sightings": 92974, "tags": [ "icmp", "udp", "alert", "tcp", "http", "snmp" ], "rule_count": 11, "classification_count": 4 }, { "ioc": "198.235.24.23", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T22:17:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:44:17Z" }, "ports": [ 0, 1434, 53, 161, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response" ], "sightings": 56334, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "128.14.224.141", "classifications": [], "first_seen": { "$date": "2023-01-23T22:19:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:19:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 12, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.134.178.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:27:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:21:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1244, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.248.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:28:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:28:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.163.125.8", "classifications": [], "first_seen": { "$date": "2023-01-23T22:35:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:35:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.236.176.33", "classifications": [], "first_seen": { "$date": "2023-01-23T22:35:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:35:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.87.254.124", "classifications": [], "first_seen": { "$date": "2023-01-23T22:36:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:36:01Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 21" ], "sightings": 3, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.104.164.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:31:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:54:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 762, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.240.236.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:32:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:30:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60229, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.146.142.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:32:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:34:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.25.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:34:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:47:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1154, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.197.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:28:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.167.149", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T22:38:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:56:54Z" }, "ports": [ 0, 1900, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 53133, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "107.170.251.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:27:04Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2373, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "190.104.183.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:39:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:39:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:40:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:36:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.61.207.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:40:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:42:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "207.244.239.70", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-01-23T22:44:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:21:58Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 17571, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "73.66.146.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:46:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:46:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.13.237.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:47:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.106.115.55", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T22:49:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:30:33Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 50455, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "122.116.131.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:53:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:55:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.38.122.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:55:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:25:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1519, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.233.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T22:57:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T22:57:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.210.101.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T22:57:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:37:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14135, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.136.195", "classifications": [], "first_seen": { "$date": "2023-01-23T23:05:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:05:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 49" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.235.24.181", "classifications": [], "first_seen": { "$date": "2023-01-23T23:11:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:11:23Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 25" ], "sightings": 1, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "1.34.100.72", "classifications": [], "first_seen": { "$date": "2023-01-23T23:12:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:12:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 2", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "114.33.2.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:01:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:01:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.221.184.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:01:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:51:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1150, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "153.193.243.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:01:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:02:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.75.118.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5065, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "179.73.176.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:06:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:06:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.98.244", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:09:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:51:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 105, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "93.175.161.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:10:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:18:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2724, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.150", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:11:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:00:54Z" }, "ports": [ 0, 22, 5632, 161, 1434, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt", "PROTOCOL-DNS named version attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29704, "tags": [ "icmp", "alert", "tcp", "ssh", "udp", "snmp" ], "rule_count": 9, "classification_count": 3 }, { "ioc": "167.248.133.129", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T23:15:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:44:53Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 85706, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "58.16.83.238", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T23:15:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:59:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 34578, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "198.235.24.132", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T23:15:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:47:51Z" }, "ports": [ 53, 0, 161, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 26746, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "152.32.141.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:17:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:17:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.38.171.57", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:18:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.12.15.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:20:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:31:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6710, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.32", "classifications": [ "Misc activity", "Detection of a Network Scan", "Information Leak", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T23:23:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:11:21Z" }, "ports": [ 0, 22, 1900, 1434, 80, 5632, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SCAN UPnP service discover attempt", "SQL ping attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "APP-DETECT PCAnywhere server response", "PROTOCOL-DNS named version attempt" ], "sightings": 50738, "tags": [ "icmp", "alert", "tcp", "ssh", "ZGrab", "udp", "http" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "218.158.27.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:25:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:26:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "208.115.230.98", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T23:25:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:34:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 112574, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "61.80.159.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:26:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:26:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.219.68.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:26:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:28:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.24.100.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:37:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:37:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.57.20.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:37:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:13:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9887, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.115.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:38:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:39:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.51.241.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:38:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:11:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4676, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.130.57.239", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T23:40:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:33:25Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP public access udp" ], "sightings": 23864, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.24", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-23T23:40:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:15:38Z" }, "ports": [ 0, 22, 53, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 23528, "tags": [ "icmp", "tcp", "ssh", "udp", "snmp" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "24.152.39.212", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:41:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:43:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4915, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "208.68.163.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:45:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6313, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.217.2.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:52:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:19:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22321, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.33.231.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-23T23:53:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-23T23:53:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "(tcp) experimental TCP options found", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "51.91.141.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-23T23:56:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:17:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36191, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.135", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected", "Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-23T23:59:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:19:05Z" }, "ports": [ 0, 22, 53, 1434, 161, 1900 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 70554, "tags": [ "icmp", "ssh", "tcp", "udp", "snmp" ], "rule_count": 11, "classification_count": 5 }, { "ioc": "162.243.150.19", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-23T23:59:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T02:29:16Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 3461, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "223.112.5.139", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:05:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:31:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 84127, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.219.168.109", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T00:06:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:01:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 141924, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.243.130.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:06:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:30:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.234.213.135", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T00:11:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:29:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 99033, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "159.203.240.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:12:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:37:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17442, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.92.17.246", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:13:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:11:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 42223, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.248.133.151", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:14:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T17:51:12Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2845, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "210.202.56.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T00:09:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:19:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 1069, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "14.42.101.70", "classifications": [], "first_seen": { "$date": "2023-01-24T00:09:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:09:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 8" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.238.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:17:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:19:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8010, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.33.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T00:19:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:20:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:22:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:45:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13550, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:23:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:47:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24540, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.11.76.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T00:24:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T06:51:41Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 47" ], "sightings": 5399, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "205.210.31.173", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:25:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:12:06Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 960, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.163", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-24T00:27:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:26:51Z" }, "ports": [ 0, 22, 177, 69 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "X11 xdmcp info query", "PROTOCOL-TFTP Get" ], "sightings": 6856, "tags": [ "icmp", "alert", "tcp", "ssh", "Go", "udp", "xdmcp", "tftp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "41.214.134.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:27:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:23:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6384, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:27:33Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:08:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4460, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.34.127.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T00:29:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:57:35Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 2", "ET 3CORESec Poor Reputation IP group 1", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 2599, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "79.10.156.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T00:29:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:30:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.217.23", "classifications": [], "first_seen": { "$date": "2023-01-24T00:24:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:24:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 41" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.152.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:32:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:04:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.169.3.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T00:34:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:34:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.112.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:36:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:25:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10472, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.13.218.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:38:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:44:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:40:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:29:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28745, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.229", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T00:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:51:41Z" }, "ports": [ 0, 80, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 16277, "tags": [ "icmp", "tcp", "http", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.189.14.236", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T00:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:53:11Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 73061, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "59.127.88.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T00:43:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:44:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.119.163", "classifications": [], "first_seen": { "$date": "2023-01-24T00:31:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:31:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 6" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "78.189.85.240", "classifications": [], "first_seen": { "$date": "2023-01-24T00:41:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:41:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 77" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.251.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:45:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:57:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7403, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:52:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:52:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.182.181.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:54:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:20:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50944, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.208.5", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:55:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:46:32Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 4875, "tags": [ "tcp", "snmp", "icmp", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.93.71", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:24:27Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4876, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "201.27.95.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T00:56:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:57:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.182.16.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:57:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:39:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 96018, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.118.63.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:58:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:50:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6011, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.187.38.158", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T00:58:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:52:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 39273, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "172.104.45.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T00:59:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:42:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 101131, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.131.70.129", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T01:00:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:50:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 100384, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "111.171.18.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T01:00:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:02:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.23.111.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:06:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:06:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.4.26.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T01:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:07:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "208.115.216.184", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T01:09:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:42:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 108994, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "74.201.30.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:09:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:48:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1550, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.129.11.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:11:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:41:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3448, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.94.81.191", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:12:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:29:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.117.14.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:17:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:29:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1342, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.154", "classifications": [ "Executable code was detected", "Misc activity", "Information Leak", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T01:17:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:49:58Z" }, "ports": [ 22, 0, 80, 161, 5632, 53 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET 3CORESec Poor Reputation IP group 25", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response", "PROTOCOL-DNS named version attempt" ], "sightings": 15026, "tags": [ "tcp", "ssh", "icmp", "alert", "http", "udp", "snmp" ], "rule_count": 11, "classification_count": 4 }, { "ioc": "114.33.89.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T01:17:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:19:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.28.117.125", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:23:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:37:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 66163, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "110.23.122.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T01:23:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:21:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 592, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.149.232.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T01:25:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:09:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3750, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:28:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:10:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4854, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.139.60.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T01:35:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T14:36:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3156, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:37:38Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:12:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14059, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.151.22.112", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T01:41:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:58:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 17023, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "81.70.5.243", "classifications": [], "first_seen": { "$date": "2023-01-24T01:42:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:26:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 4423, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "37.44.238.97", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:43:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:44:09Z" }, "ports": [ 161, 0, 80 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 26" ], "sightings": 481, "tags": [ "udp", "snmp", "icmp", "alert", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "64.62.197.34", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:46:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:03:56Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3784, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.218.206.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:46:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:44:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:48:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:16:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19229, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.178.130.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:48:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:47:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:48:51Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:14:21Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 12166, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "68.183.90.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:50:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:46:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 61575, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.144.253.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:52:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:52:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:53:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:53:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.182.180.242", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T01:53:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:42:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 25047, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "18.133.240.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:54:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 100, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.237.119.46", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T01:57:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 100, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.229.22.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:00:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:00:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.29.139.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:00:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:02:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.66.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:04:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:04:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.201.52.181", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T02:06:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 100, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "3.234.154.46", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T02:06:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:07:23Z" }, "ports": [ 20003, 2129, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp" ], "sightings": 6, "tags": [ "tcp", "snmptrap" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.35", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:10:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:56:53Z" }, "ports": [ 0, 53, 80, 161, 22, 5632, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response", "SQL ping attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34153, "tags": [ "icmp", "udp", "alert", "tcp", "http", "snmp", "ssh" ], "rule_count": 9, "classification_count": 3 }, { "ioc": "45.138.19.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T02:12:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:12:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.118.39.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T02:12:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:25:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36362, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.223", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T02:16:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:47:10Z" }, "ports": [ 69, 0, 80, 177 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "(stream_tcp) data on SYN packet", "X11 xdmcp info query" ], "sightings": 1814, "tags": [ "udp", "tftp", "icmp", "alert", "tcp", "http", "xdmcp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "178.198.61.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:20:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.128", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T02:20:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:31:24Z" }, "ports": [ 53, 0, 161, 1900, 80 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 47107, "tags": [ "udp", "icmp", "snmp", "alert", "tcp", "http" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "121.191.6.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:21:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:21:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.32.72.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:22:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:31:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.144.156.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:23:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:24:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.11.106.181", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T02:24:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:50:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 45141, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.158", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-24T02:28:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:41:52Z" }, "ports": [ 0, 69 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 24, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.24", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:29:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:41:15Z" }, "ports": [ 0, 80, 5632, 53, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET 3CORESec Poor Reputation IP group 27", "APP-DETECT PCAnywhere server response", "PROTOCOL-DNS named version attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13138, "tags": [ "icmp", "alert", "tcp", "http", "udp", "ssh" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "64.62.197.154", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T02:30:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:27:44Z" }, "ports": [ 0, 22, 177 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "X11 xdmcp info query" ], "sightings": 8393, "tags": [ "icmp", "alert", "tcp", "ssh", "udp", "xdmcp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "1.160.145.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:30:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:30:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "105.224.192.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:33:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:34:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.72.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:37:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:37:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.89.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:40:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:41:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.248.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:41:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:34:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 42", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 7, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "113.209.132.146", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T02:46:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:52:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 49090, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T02:48:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T07:29:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2072, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.198.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:50:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:51:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "100.38.110.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T02:53:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:57:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 32422, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.250.69", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T02:53:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:53:44Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 2, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.160.115.155", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T02:53:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:53:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.106.115.39", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T02:55:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:40:16Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 13270, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "182.214.122.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:56:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:31:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2323, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.62.191.220", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T02:57:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:38:52Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 22859, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "121.152.79.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:57:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:59:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.160.66", "classifications": [], "first_seen": { "$date": "2023-01-24T03:02:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:02:11Z" }, "ports": [ 7443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.95.75.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:03:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:06:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 63709, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.218.206.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:09:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.40.68.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T03:11:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:12:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.225", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:12:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:57:01Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2154, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "37.252.66.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T03:17:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:50:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 586, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.226.35", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:19:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:43:58Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3280, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.234", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T03:19:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:24:32Z" }, "ports": [ 0, 1434, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 15730, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "107.170.226.14", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:19:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T15:00:18Z" }, "ports": [ 53, 0, 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 1773, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "118.194.251.25", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:21:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:21:54Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "81.213.140.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T03:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:19:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 80" ], "sightings": 1060, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "74.82.47.42", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-24T03:31:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:05:01Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 27202, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "114.35.90.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T03:32:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:33:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:35:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.57", "classifications": [ "Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T03:36:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:06:36Z" }, "ports": [ 0, 1434, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 30735, "tags": [ "icmp", "udp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "64.62.197.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:38:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:59:53Z" }, "ports": [ 0, 1434, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 34231, "tags": [ "icmp", "udp", "alert", "tcp", "ssh", "Go" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "74.82.47.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:39:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:23:43Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32748, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.30.232.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T03:41:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:43:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.176.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:43:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:43:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.109", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T03:45:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:40:23Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 79650, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.63", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T03:46:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:15:57Z" }, "ports": [ 0, 22, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 30725, "tags": [ "icmp", "alert", "tcp", "ssh", "Go", "udp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "45.250.225.44", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:46:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:46:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "221.157.65.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T03:53:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:53:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.180.79.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T03:54:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:55:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.201.53.112", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T03:57:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:28:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 50084, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "173.164.40.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T03:59:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T04:00:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.132.12.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:04:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:41:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62446, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.45.242.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:04:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:10:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 8" ], "sightings": 6, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "216.218.206.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:05:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:25:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1178, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.51.106.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:05:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T04:05:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.147.171.2", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:05:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:41:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 26245, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.73", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T04:07:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T00:38:25Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 12946, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.240", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T04:09:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:56:05Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 24916, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "37.143.131.192", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:11:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:46:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 95226, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.82.47.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:32:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11730, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:13:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:31:16Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4232, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "172.104.94.121", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T04:14:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:20:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 229535, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "172.105.205.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:17:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:28:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2266, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.189", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:17:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:17:34Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 93167, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.219.168.126", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:18:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:12:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 118605, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.174.252.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:22:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:47:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38022, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.48.136.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:26:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:17:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 88" ], "sightings": 302, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "109.235.71.231", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T04:29:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:42:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 49743, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:29:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:59:22Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 67198, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "182.70.250.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:30:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T04:30:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.150.240.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:31:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:38:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45768, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.197.160.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:35:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:54:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10905, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.57.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:44:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T04:45:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.220", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-24T04:45:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:28:57Z" }, "ports": [ 1434, 0, 111 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 924, "tags": [ "udp", "icmp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.104.92.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:45:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:06:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.131.70.134", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:45:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:39:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 46726, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.33.127.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T04:46:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.93.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:48:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:20:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 514, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.68", "classifications": [ "Attempted Information Leak", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-24T04:49:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:47:54Z" }, "ports": [ 177, 0, 80, 111 ], "reporting_nodes": 3, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 68", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 1802, "tags": [ "udp", "xdmcp", "icmp", "alert", "tcp", "http", "sunrpc", "portmapper" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "74.82.47.26", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:49:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:54:46Z" }, "ports": [ 1900, 0, 80 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 6811, "tags": [ "udp", "icmp", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.233.172.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:49:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T04:51:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.187", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:51:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:11:22Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20464, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.218.206.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:51:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:20:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12006, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.33.110.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:58:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:32:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 107626, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T04:58:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:41:22Z" }, "ports": [ 1434, 0, 5632 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 5421, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "198.235.24.139", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T05:06:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:04:10Z" }, "ports": [ 5632, 0, 1434, 53 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 26667, "tags": [ "udp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "122.116.170.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T05:06:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:07:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.100.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:08:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:08:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.235", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-24T05:11:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:22:13Z" }, "ports": [ 0, 111, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 8723, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "alert", "tcp", "ssh", "Go" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "74.82.47.30", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:15:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:34:38Z" }, "ports": [ 1900, 0, 80 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "(stream_tcp) reset outside window" ], "sightings": 39865, "tags": [ "udp", "icmp", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "91.134.185.85", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T05:16:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:45:02Z" }, "ports": [ 177, 0, 161, 1900, 53 ], "reporting_nodes": 1, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 59657, "tags": [ "udp", "xdmcp", "icmp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "185.255.123.226", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:18:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:10:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 87837, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.117.33.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T05:24:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:25:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.133.80.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T05:29:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:38:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6138, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.252.251", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:33:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:23:41Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "190.138.240.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:29:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 844, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.68.226", "classifications": [], "first_seen": { "$date": "2023-01-24T05:40:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:46:23Z" }, "ports": [ 6443, 8081 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 332, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "116.211.239.114", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:44:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:47:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 32098, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.142.125.180", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T05:49:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:53:38Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 62246, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "78.193.218.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:50:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:50:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.4.171.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:50:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:28:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2494, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.18.239.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:50:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:50:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.184.59.71", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T05:51:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:47:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 82558, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.79.198.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T05:54:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:55:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.159.154.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T05:55:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:56:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.20.171.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:00:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:00:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:26:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25812, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.209.84.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:01:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:31:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 245206, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.228.150.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:02:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:43:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 10, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "222.118.169.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:05:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:06:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.146", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T06:08:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:01:15Z" }, "ports": [ 5632, 0, 161, 22 ], "reporting_nodes": 3, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ET 3CORESec Poor Reputation IP group 25" ], "sightings": 26308, "tags": [ "udp", "icmp", "snmp", "alert", "tcp", "ssh" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "219.92.184.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:11:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:12:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.161.23.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:12:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:55:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2591, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.216.168.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:12:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:13:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.110.115.98", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:13:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:47:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 41142, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.79.170.233", "classifications": [], "first_seen": { "$date": "2023-01-24T06:14:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:18:30Z" }, "ports": [ 10443, 993, 9000, 3389, 995, 8088, 50001, 58603 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 16284, "tags": [ "tcp", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:17:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:47:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7288, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "73.57.148.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:27:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:29:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.199.172.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:28:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:28:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.4.233.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:32:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:32:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.162.159.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:33:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:33:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.194.81.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:33:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:41:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:35:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.141.253.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:49:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3092, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.92.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:41:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:41:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:41:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:37:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16844, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.16.171.157", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.105.171.15", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:31:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 25530, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "173.208.98.160", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.104.11.142", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:48:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "148.72.168.129", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.245.160.210", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.133.193.246", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10209, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.152.50.220", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:48:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.145.53", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.231.90.170", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "46.183.217.222", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "209.58.131.6", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.49.32", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.71.244.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.194.84.55", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.101.26.137", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "72.41.0.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.9.35.222", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.3.163.17", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.185.99.65", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.144.179.165", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.188.214.56", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:06:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 205713, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.53.223.145", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.96.108", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.71.26.28", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:35:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10220, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "141.95.29.226", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:42:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.36.119.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.10.173.48", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.90.61.163", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.16.64", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.66.114.70", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.36.81", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.126.237.183", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.77.235.178", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4935, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "151.236.23.64", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "142.4.215.160", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "46.183.185.20", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:26:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5090, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.204.24.63", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "209.124.84.198", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.213.20.229", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.70.76", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.143.131.54", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.143.129.146", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.104.174.145", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "77.247.111.20", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.187.250.199", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:49:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.161.203.63", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:28:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10305, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.126.238.217", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.220.83.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.213.22.206", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.35.237.180", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.108.130.116", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.131", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:43:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:31:26Z" }, "ports": [ 0, 1900, 22, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55425, "tags": [ "icmp", "udp", "alert", "tcp", "ssh" ], "rule_count": 6, "classification_count": 4 }, { "ioc": "15.228.98.227", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.237.185.238", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.222.185.160", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.59.59.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.74.160.237", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.246.131.11", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:40:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4970, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.104.92.239", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.74.136.190", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "94.20.154.70", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.81.21.190", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:14:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 206278, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "203.23.128.215", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "46.183.184.43", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "147.78.1.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:31:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11495, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.246.2.97", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.231.233.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:43:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:42:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 25450, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.205.212.215", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "209.94.191.44", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:43:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 25430, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.75.116.190", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:53:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4928, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "31.14.238.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.250.49.98", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "208.115.210.244", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.163.218.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "147.78.3.201", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "178.175.137.16", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4945, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "123.172.53.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:44:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.208.71.43", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.162.217.84", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.186.78.181", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.244.207.190", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.99.23.79", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.189.221.56", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.126.236.209", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.186.77.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:49:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.240.206.92", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:51:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.69.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.209.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:51:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2836, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.44.193.185", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.252.177.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.137.151.84", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.255.123.20", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.105.21.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:51:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.99.119.114", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.188.133.153", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.185.215.117", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.189.223.251", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:56:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6410, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.53.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.22.88", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.103.177.15", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.39.182.57", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5100, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.188.35.96", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:44:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6292, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "46.148.113.181", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4990, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "8.28.86.109", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5100, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "92.223.79.236", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.44.198.94", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "129.250.35.251", "classifications": [], "first_seen": { "$date": "2023-01-24T06:45:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:51:08Z" }, "ports": [ 34317, 52019, 56916, 51794, 41376, 53335, 43207, 45095, 43721, 56575, 39878, 38460, 33580, 58787, 44604, 53803, 51251, 37412, 37874, 60118, 38055, 51281, 41723, 60262, 38036, 35209, 53403, 50901, 46756, 43634, 55193, 47878, 36901, 59239, 46128, 42025, 35969, 38424, 60760, 59034, 54454, 33954, 58862, 32779, 47039, 47057, 53521, 39579, 34195, 41706, 49398, 56909, 43991, 53268, 40437, 58182, 38237, 42566, 59692, 55724, 55749, 36087, 54008, 48289, 47935, 45251, 35515, 35616, 59918, 60888, 37546, 47451, 60044, 56115, 52878, 37165, 48121, 56167, 56780, 42224, 48837, 33141, 36960, 49999, 36766, 47276, 57057, 33719, 38897, 57896, 32995 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 202927, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "145.14.131.235", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4930, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.56.91.178", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:51:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "147.78.0.90", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "92.38.131.214", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.28.87.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:45:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:45:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.156.157.143", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "207.182.135.186", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.27.55", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.42.141", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.156.138.177", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.63.234.94", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.43.208.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:51:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.170.143.75", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "92.38.149.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:31:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10260, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "197.189.207.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "3.236.185.91", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:51:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.62.79", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.88.248.38", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.230.64.175", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "208.115.230.102", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "95.85.72.187", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.185.219.214", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:42:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 25429, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.187.83.140", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.66.77", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:39:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.126.239.200", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4945, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.125.141.49", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.189.201.217", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.231.92.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.27.115.65", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "81.28.13.20", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "208.115.223.211", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:42:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4890, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.106.49.41", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.188.4.64", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:53:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10033, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "177.84.130.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.208.80.26", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.91.191.84", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.177.11", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.213.233.13", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.130.65", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.44.238.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:53:29Z" }, "ports": [ 0, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 26" ], "sightings": 18622, "tags": [ "icmp", "alert", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "3.96.189.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "92.223.90.41", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.220.1.194", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.46.227.173", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.83.211", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.231.166.115", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.203.169.194", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.142.153.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.126.60.88", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.160.117", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.16.75", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "18.181.172.118", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.199.11", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:45:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.198.93.56", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.93.221.194", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "108.136.224.33", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.59.56.101", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.146.21.161", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.218.116.15", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.92.153.76", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.220.137.201", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.151.156.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.236.44.43", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "92.38.135.237", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.118.186.163", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.146.31.103", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.78.87.182", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.146.8.53", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.234.84.80", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.90.106.90", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.220.17.199", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:52:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.108.129.183", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10088, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.226.50.120", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.219.104.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.196.200.165", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "4.198.64.193", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 35, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.38.157", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.220.236.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.213.23.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "3.133.134.126", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.27.107.50", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.146.0.39", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.172.192.25", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.210.147.211", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.159.76.108", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.3.24", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.237.189.57", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.193.241.0", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "208.115.225.97", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:42:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.211.28.188", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 35, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "94.16.98.33", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.15.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5090, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "16.171.62.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "178.255.154.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.186.79.152", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.69.32.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.12.10.37", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.45.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.192.124.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.21.101.244", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.252.246.37", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10017, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.252.247.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.252.232.161", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.128.189.36", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6195, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.146.4.161", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.253.5.146", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.172.212.111", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.172.254.161", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:40:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4970, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.188.168.53", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.187.128.215", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.125.109.26", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.118.138.126", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.48.142.148", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:49:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.152.73.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:53:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "178.255.153.41", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.252.225.103", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.146.30.243", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.252.231.161", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.113.140.49", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "40.86.226.129", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:54:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 35, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.191.80.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.172.245.17", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "85.239.41.155", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:47:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:02:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.143.130.227", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.87.221.79", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:54:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.160.207.83", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:54:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 35, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.101.139.61", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.201.15.248", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.245.114.204", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:55:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.19", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:48:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:13:25Z" }, "ports": [ 0, 53, 5632, 161, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38332, "tags": [ "icmp", "udp", "snmp", "alert", "tcp", "ssh" ], "rule_count": 11, "classification_count": 4 }, { "ioc": "74.82.47.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:32:39Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 12808, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "195.80.149.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.243.84.44", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:48:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "159.100.244.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:49:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.138.86.246", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:49:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "108.62.158.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:49:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.132.149.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:50:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:39:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6574, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.243.140.50", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:53:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "14.53.77.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:53:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:54:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.38.132.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:54:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4900, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "206.53.48.61", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:54:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:48:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.79.3.147", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:54:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:01:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.230.223.46", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:54:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T04:03:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3215, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.132.14.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T06:56:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.2.177.108", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:56:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:43:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 91228, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.65.120.98", "classifications": [], "first_seen": { "$date": "2023-01-24T06:56:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T06:56:38Z" }, "ports": [ 34511 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "146.190.115.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T06:58:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:40:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.239.8.82", "classifications": [], "first_seen": { "$date": "2023-01-24T07:02:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:21:35Z" }, "ports": [ 50001, 8080, 8088, 8081, 8083, 58603 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 287, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.210.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:03:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.113.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:05:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:06:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.240.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:05:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:42:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.183.197.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:06:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:07:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.161.166.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:06:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:07:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.103", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-24T07:10:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:55:26Z" }, "ports": [ 0, 80, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "PROTOCOL-TFTP Get" ], "sightings": 1399, "tags": [ "icmp", "tcp", "http", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.92.22.113", "classifications": [], "first_seen": { "$date": "2023-01-24T07:12:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:14:48Z" }, "ports": [ 8888, 8083, 4443, 8081, 10443, 995, 9000, 8080, 993, 8443, 58603, 3389, 8008, 9443, 50001 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 18866, "tags": [ "tcp", "http", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.195.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:15:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:21:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 908, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.158.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:16:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:16:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.26.88.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:16:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:16:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.218.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:16:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:51:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1858, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.205.208.221", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T07:20:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 86392, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "175.202.156.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:21:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:59:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 526, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:23:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T07:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2566, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.143", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T07:23:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:56:26Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 98531, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.142", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T07:25:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:16:05Z" }, "ports": [ 1900, 0, 22, 161, 5632, 1434, 53 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response", "SQL ping attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 32226, "tags": [ "udp", "icmp", "alert", "tcp", "ssh", "snmp" ], "rule_count": 9, "classification_count": 3 }, { "ioc": "222.114.139.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:25:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:16:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 628, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.213.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:27:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:18:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6064, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.154.70.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:27:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:28:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.217.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:27:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:27:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.146.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:30:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:30:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.45.51.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:32:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:18:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1042, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.25", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T07:33:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:21:53Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 10250, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.193.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:39:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 718, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.181.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:37:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:45:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1358, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.250.52.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:38:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:04:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10191, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.36.118.15", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:38:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:00:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12177, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.117.61.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:39:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:40:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.119.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:45:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:48:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.114.224.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T07:45:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T16:10:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 28" ], "sightings": 679, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.162.212.214", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T07:46:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:57:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 45543, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "107.170.252.25", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T07:54:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:25:32Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 21, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.142.125.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:54:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:33:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27962, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.221.36.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:55:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:55:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.61.39.154", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T07:55:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:21:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 77828, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "65.49.20.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:00:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:36:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1402, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.235.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:02:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:02:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5112, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.98.215.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:02:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:34:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12064, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.132.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:03:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:25:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16956, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.12", "classifications": [ "Executable code was detected", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:07:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:17:33Z" }, "ports": [ 22, 161, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20079, "tags": [ "tcp", "ssh", "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "190.138.240.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:08:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:08:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.34.1.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:10:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:10:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.161.88.35", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T08:11:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:02:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 61820, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "213.135.0.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:11:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:11:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Time-To-Live Exceeded in Transit" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.167.131", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T08:11:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:34:23Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 39918, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "61.97.199.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:11:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:13:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.72.157.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:13:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "105.184.194.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:18:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:19:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.113.91.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:22:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:50:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 884, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.190.69.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:22:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:22:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.209.202.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:24:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:26:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.15", "classifications": [ "Misc activity", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:24:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:48:29Z" }, "ports": [ 0, 22, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt" ], "sightings": 32405, "tags": [ "icmp", "tcp", "ssh", "udp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "198.235.24.41", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T08:30:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:37:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 47333, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.137", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-24T08:30:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:31:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12150, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "65.49.20.112", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:31:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:36:36Z" }, "ports": [ 111, 0, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 2747, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "65.49.20.80", "classifications": [ "Decode of an RPC Query", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T08:33:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:21:12Z" }, "ports": [ 111, 0, 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 2483, "tags": [ "udp", "sunrpc", "portmapper", "icmp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "125.163.9.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:36:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:36:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.20.185.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:31:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2298, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.102.49.193", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:41:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:23:08Z" }, "ports": [ 0, 161, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63393, "tags": [ "icmp", "udp", "snmp", "tcp", "ssh" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "193.42.33.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:44:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:44:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.196.89.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:45:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:36:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1003, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.98.190.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:47:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:53:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.243.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:47:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:46:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 586, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.90.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:47:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:48:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.100", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-24T08:48:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:30:52Z" }, "ports": [ 80, 0, 111 ], "reporting_nodes": 3, "rules": [ "(stream_tcp) data on SYN packet", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 51, "tags": [ "tcp", "http", "alert", "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "192.241.232.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:48:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:25:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6776, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.205.57.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:48:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:49:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.245.207.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:50:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T13:18:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.103.134.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:55:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:50:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 332, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.239", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-24T08:55:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:05:00Z" }, "ports": [ 0, 177, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "PROTOCOL-TFTP Get" ], "sightings": 4235, "tags": [ "icmp", "udp", "xdmcp", "tftp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "222.186.170.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:56:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:49:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11154, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.20.138.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T08:56:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:36:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1184, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.239.207.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:59:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T09:02:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:59:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:42:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28488, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.166", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T08:59:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:09:34Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "SQL ping attempt", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5074, "tags": [ "icmp", "udp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "193.9.112.138", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:02:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:06:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 80663, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.32", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-24T09:02:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:12:19Z" }, "ports": [ 0, 80, 22, 69 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-TFTP Get" ], "sightings": 18970, "tags": [ "icmp", "alert", "tcp", "http", "ssh", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.187.109.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:05:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:54:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18848, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.210.28.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T09:09:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T09:10:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.116.78.151", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T09:10:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T01:28:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 64902, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:10:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:19:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.200.63.216", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T09:17:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:55:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 75672, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "177.184.97.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T09:18:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T09:20:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "133.149.91.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:25:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T09:25:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.148.134.214", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:26:59Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:25:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 47719, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "175.139.13.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:28:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T09:28:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:29:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:29:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8270, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.247.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:32:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:30:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:34:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:20:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11320, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.107.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T09:37:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:34:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 48" ], "sightings": 11568, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "205.210.31.26", "classifications": [ "Attempted Information Leak", "Misc activity", "Executable code was detected", "Information Leak" ], "first_seen": { "$date": "2023-01-24T09:42:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:16:23Z" }, "ports": [ 161, 0, 22, 5632 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "APP-DETECT PCAnywhere server response", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 24518, "tags": [ "udp", "snmp", "icmp", "tcp", "ssh" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "204.76.203.130", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:46:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T09:46:54Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.66", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T09:47:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:58:38Z" }, "ports": [ 0, 161, 22, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ET DROP Dshield Block Listed Source group 1", "(stream_tcp) data on SYN packet" ], "sightings": 2602, "tags": [ "icmp", "udp", "snmp", "alert", "tcp", "ssh", "http" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "216.218.206.109", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T09:49:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:23:39Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 7830, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.212.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:56:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:10:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35464, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.4.122.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T09:57:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T09:59:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.240.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T09:59:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:29:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19100, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.144.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:03:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:10:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2786, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.250.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:05:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:04:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15417, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:05:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:46:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.127.124.47", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:07:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:42:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 62802, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:07:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:15:53Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 40840, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "113.192.67.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:11:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:13:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.97.112.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:17:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:17:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.141.142", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:21:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:21:41Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.200.189.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:24:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:24:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "114.33.29.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:30:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:30:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.133.64.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:31:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:35:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 710, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.160.41.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:31:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:56:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 32" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "65.28.51.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:33:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:16:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 576, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.82.44", "classifications": [], "first_seen": { "$date": "2023-01-24T10:33:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:33:17Z" }, "ports": [ 5431 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.34.16.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:42:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:43:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.23", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T10:52:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:08:13Z" }, "ports": [ 0, 22, 1900 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 5327, "tags": [ "icmp", "alert", "tcp", "ssh", "Go", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.142.125.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:53:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:53:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.105.209.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:53:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:19:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32944, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.233.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:53:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:53:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:53:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:41:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2240, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.38.231.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:54:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:32:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34952, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.119.58", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T10:55:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:33:34Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 8218, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "80.82.77.139", "classifications": [ "Misc activity", "Potentially Bad Traffic", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T10:55:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:11:12Z" }, "ports": [ 0, 69, 1900, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP NULL command attempt", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP request udp" ], "sightings": 124934, "tags": [ "icmp", "udp", "tftp", "snmp" ], "rule_count": 5, "classification_count": 4 }, { "ioc": "59.23.121.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:56:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:48:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 57" ], "sightings": 66, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "222.175.101.109", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:56:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:28:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 63562, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "80.108.16.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T10:56:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:56:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.214.206.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:57:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.150.253.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T10:56:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:58:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.117.95.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T11:01:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:01:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.182.16.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:09:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:10:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25311, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.175.151", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:10:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:50:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 90205, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.119.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:10:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:42:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2860, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.150.84.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T11:10:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:11:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.135.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T11:13:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:14:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.44.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:16:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:16:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.126.201.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:18:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:18:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.213.108.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T11:19:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:19:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.43.0.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T11:28:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:34:25Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 92" ], "sightings": 3908, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "212.129.60.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:29:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:51:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7040, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.144.133.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:29:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:29:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.178.43.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:37:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:37:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.229.90.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T11:42:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:42:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.81.122.28", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T11:42:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:50:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 164484, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "154.16.180.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:45:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:31:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 51525, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.160.51.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:50:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:50:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.136.185.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T11:53:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T01:43:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3888, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "155.94.222.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T11:55:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:04:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 31315, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.152.245.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:03:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:04:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.242.47.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:05:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:48:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1256, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.100", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T12:10:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:42:47Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 40072, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "120.232.252.226", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T12:10:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:41:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 67504, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "212.83.181.11", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-24T12:12:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:53:46Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10932, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "118.232.39.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:15:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.226.194.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:20:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:27:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 357, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "197.155.234.157", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:27:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:00:10Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23275, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "73.207.128.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:28:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:30:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.131", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T12:37:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:16:45Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 33986, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.150.243.129", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T12:44:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:58:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 110569, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.126.80.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:47:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:18:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1358, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.199.163.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:49:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:51:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.116.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T12:50:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:40:42Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1104, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "94.183.47.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T12:50:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:51:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.90.247.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T12:54:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:32:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34358, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.98.241.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T13:09:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:09:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.75.38.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:10:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:11:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.141.194.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:13:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:32:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7465, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.38.190.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:14:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:59:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.47.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:16:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:18:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.89.4.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:19:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:20:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.122.188.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:23:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:24:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 713, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.205.241.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:27:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:11:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6543, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.31.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:28:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:29:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 710, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.13.221.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:30:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:35:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1929, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.231.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:36:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:36:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 708, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.27", "classifications": [], "first_seen": { "$date": "2023-01-24T13:37:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:37:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 354, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "92.205.165.95", "classifications": [], "first_seen": { "$date": "2023-01-24T00:55:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:04:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 33, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.229.100.222", "classifications": [], "first_seen": { "$date": "2023-01-24T00:56:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T00:56:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 10" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "223.245.0.5", "classifications": [], "first_seen": { "$date": "2023-01-24T01:23:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:05:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 32", "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 551, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "14.47.57.72", "classifications": [], "first_seen": { "$date": "2023-01-24T01:26:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:26:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 9" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.32.168.119", "classifications": [], "first_seen": { "$date": "2023-01-24T01:29:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:29:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 5" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.142.125.220", "classifications": [], "first_seen": { "$date": "2023-01-24T01:56:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T01:56:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "50.250.34.202", "classifications": [], "first_seen": { "$date": "2023-01-24T02:00:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:00:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 44" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "24.250.173.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T02:11:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:25:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 14", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 649, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "159.203.192.9", "classifications": [], "first_seen": { "$date": "2023-01-24T02:45:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T02:45:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "49.213.200.236", "classifications": [], "first_seen": { "$date": "2023-01-24T03:00:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:00:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 41" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.33.106.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T03:00:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:55:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 565, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "67.205.162.175", "classifications": [], "first_seen": { "$date": "2023-01-24T03:05:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:05:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 69" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "134.209.88.211", "classifications": [], "first_seen": { "$date": "2023-01-24T03:08:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T03:09:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh", "anomaly" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "39.102.204.106", "classifications": [], "first_seen": { "$date": "2023-01-24T03:10:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:44:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 34", "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 519, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "122.117.58.73", "classifications": [], "first_seen": { "$date": "2023-01-24T04:29:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T04:29:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.229.30.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T04:55:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:46:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1710, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "34.201.250.36", "classifications": [], "first_seen": { "$date": "2023-01-24T05:04:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:42:53Z" }, "ports": [ 49018, 53042, 42748 ], "reporting_nodes": 2, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", "(http_inspect) HTTP Content-Length message body was truncated" ], "sightings": 687, "tags": [ "alert", "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.127.113.187", "classifications": [], "first_seen": { "$date": "2023-01-24T05:42:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T05:42:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 54" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.79.181.223", "classifications": [], "first_seen": { "$date": "2023-01-24T06:17:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:17:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 36", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1699, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.126.62.135", "classifications": [], "first_seen": { "$date": "2023-01-24T06:28:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:41:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 53", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "185.224.128.219", "classifications": [], "first_seen": { "$date": "2023-01-24T06:35:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:55:32Z" }, "ports": [ 80, 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 4047, "tags": [ "alert", "tcp", "http", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "80.82.70.228", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T06:49:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:15:35Z" }, "ports": [ 80, 161, 22 ], "reporting_nodes": 3, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 79", "ET 3CORESec Poor Reputation IP group 44", "PROTOCOL-SNMP request tcp" ], "sightings": 710, "tags": [ "alert", "tcp", "http", "snmp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "98.63.38.102", "classifications": [], "first_seen": { "$date": "2023-01-24T07:08:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:08:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 92" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "106.1.109.116", "classifications": [], "first_seen": { "$date": "2023-01-24T07:58:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T07:58:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 100" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.77.96", "classifications": [], "first_seen": { "$date": "2023-01-24T08:23:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:30:06Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 11" ], "sightings": 382, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.190.26.186", "classifications": [], "first_seen": { "$date": "2023-01-24T08:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:43:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 70" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "85.233.150.77", "classifications": [], "first_seen": { "$date": "2023-01-24T08:52:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T08:52:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 83" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.127.243.201", "classifications": [], "first_seen": { "$date": "2023-01-24T10:07:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:46:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 55" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "73.248.213.94", "classifications": [], "first_seen": { "$date": "2023-01-24T10:22:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T10:22:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 74" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.248.163.219", "classifications": [], "first_seen": { "$date": "2023-01-24T10:42:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:01:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS" ], "sightings": 1415, "tags": [ "alert", "tcp", "ssh", "anomaly", "http" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "91.240.118.111", "classifications": [], "first_seen": { "$date": "2023-01-24T11:06:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T11:06:46Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 87" ], "sightings": 1, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.117.118.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T11:40:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:26:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 951, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T12:05:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:20:50Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1046, "tags": [ "alert", "tcp", "http", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "45.79.181.179", "classifications": [], "first_seen": { "$date": "2023-01-24T12:15:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:14:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 347, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.34.183.9", "classifications": [], "first_seen": { "$date": "2023-01-24T12:30:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T12:30:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 5" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "49.162.65.155", "classifications": [], "first_seen": { "$date": "2023-01-24T13:17:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:22:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 40" ], "sightings": 675, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.50.43.103", "classifications": [], "first_seen": { "$date": "2023-01-24T13:17:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:17:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 9" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.47.34.246", "classifications": [], "first_seen": { "$date": "2023-01-24T13:36:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:36:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum" ], "sightings": 78, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "36.110.228.254", "classifications": [], "first_seen": { "$date": "2023-01-24T13:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T01:51:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 34" ], "sightings": 68, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.148.10.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T13:41:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:01:09Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 33" ], "sightings": 92851, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "122.114.37.27", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T13:43:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:18:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 55889, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "220.132.40.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:45:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:45:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 740, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.128.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:47:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 740, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T13:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:41:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13200, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.31.32.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:54:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:54:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 740, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.160.140.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:55:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:55:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 740, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.134.102.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T13:56:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:56:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 740, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.248.10", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T13:59:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:43:01Z" }, "ports": [ 162, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 896, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "210.209.145.27", "classifications": [], "first_seen": { "$date": "2023-01-24T13:59:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T13:59:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 28" ], "sightings": 17, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "82.55.77.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:01:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:02:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 738, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.138.186.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:04:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:05:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 738, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.226.223.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:05:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:06:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 738, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "199.119.65.153", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:08:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:53:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55788, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.117.63.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:10:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 738, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.221.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:16:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:59:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 737, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.121.169.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:18:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:20:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1840, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.193.116.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:20:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:19:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11497, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.216.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:22:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:23:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "96.69.52.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:24:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:24:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 736, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.38.80.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:25:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:25:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 736, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.93.130.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:27:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:29:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 736, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.107.11.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:32:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 734, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.21.48.186", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:36:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:43:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 35118, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.116.14.17", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T14:38:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:42:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 106093, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "104.218.166.207", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:41:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:59:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4757, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.127.22.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:44:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:44:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 734, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.194.54", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:44:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:18:22Z" }, "ports": [ 111, 0, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 1113, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.133.142.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:31:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:42:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 30", "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 610, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "220.141.15.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:46:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:48:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 732, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.92.229", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:50:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:46:10Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3121, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.230.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:50:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:07:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9604, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.124.206.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:50:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:54:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1650, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.127.161.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:52:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:26:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1847, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:54:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:23:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 734, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.148.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T14:57:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:57:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 732, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.238.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:57:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T14:57:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 732, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.46.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T14:58:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:35:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2491, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.242.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:00:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T02:23:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 740, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.239.34.246", "classifications": [], "first_seen": { "$date": "2023-01-24T14:50:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:07:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 83", "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 522, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "159.203.192.16", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T15:01:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:09:26Z" }, "ports": [ 0, 161, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "(sip) content length mismatch" ], "sightings": 4611, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "121.143.73.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:03:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:05:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 730, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.74.132.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:05:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:06:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 730, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.94.182.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:28:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6082, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.199.23", "classifications": [ "Misc activity", "Potentially Bad Traffic", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T15:07:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:25:14Z" }, "ports": [ 0, 69, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP NULL command attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 87379, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "198.199.119.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:09:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:37:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2334, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:22:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15706, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.239.21", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T15:23:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:53:59Z" }, "ports": [ 0, 161, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP request udp", "(ssh) payload size incorrect for the given payload" ], "sightings": 4954, "tags": [ "icmp", "tcp", "snmp", "udp", "ssh" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "98.164.126.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:24:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:25:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 728, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.46.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:24:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:20:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2073, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.159.193.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:26:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:27:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 728, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.70.93.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:28:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:28:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 728, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.153.165.221", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T15:29:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:54:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 66324, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "164.52.25.253", "classifications": [], "first_seen": { "$date": "2023-01-24T15:22:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:22:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 67", "ET 3CORESec Poor Reputation IP group 16" ], "sightings": 22, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.202.21", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T15:34:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:56:36Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 2104, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.224.202.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:34:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:35:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 726, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.148.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:39:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:19:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 730, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.107.45.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:39:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T10:08:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 21", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4638, "tags": [ "alert", "tcp", "ssh", "HELLOWORLD", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "217.115.58.242", "classifications": [], "first_seen": { "$date": "2023-01-24T15:43:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:43:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.101.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:45:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:33:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10224, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.107.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:45:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:38:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5304, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.115.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:48:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:37:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1440, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.202.35.42", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T15:49:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:45:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 73655, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "62.118.138.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:53:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:54:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 724, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.84.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:22:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5669, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.123.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:40:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37382, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.137.46.19", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:56:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:01:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 91567, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.147.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:57:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:23:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.31.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:57:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T15:58:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 724, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T15:58:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:56:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.35.53.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T15:58:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:23:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1255, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.186.224.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:00:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:55:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30397, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.115.23.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:04:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:06:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 720, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "90.227.110.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:04:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:06:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 720, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.156.245", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:08:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:33:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 98109, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.114.202", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T16:09:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:27:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 2019, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "151.14.197.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:09:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:26:00Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2284, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.193.64.2", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:10:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:10:43Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2520, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.103.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:11:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:24:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17287, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.114.200.113", "classifications": [], "first_seen": { "$date": "2023-01-24T16:00:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:00:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 8, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.145.12", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:15:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:43:29Z" }, "ports": [ 161, 0, 22 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 19101, "tags": [ "udp", "snmp", "icmp", "tcp", "ssh" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "1.34.133.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:16:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:02:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2074, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.131", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T16:18:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:07:31Z" }, "ports": [ 161, 0, 1900, 53, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt", "SQL ping attempt" ], "sightings": 42902, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "107.170.225.6", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:19:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:01:45Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4546, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "65.189.2.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:20:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:20:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 718, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.144.56.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:22:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:00:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2046, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:22:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T10:23:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12761, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.130", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T16:24:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:54:01Z" }, "ports": [ 0, 22, 161, 1900, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "APP-DETECT PCAnywhere server response" ], "sightings": 45616, "tags": [ "icmp", "tcp", "ssh", "udp", "snmp" ], "rule_count": 7, "classification_count": 4 }, { "ioc": "162.142.125.190", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T16:26:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:08:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 75965, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.142.125.186", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:26:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:23:50Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52460, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.141.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:28:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:28:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 718, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.140.187.170", "classifications": [], "first_seen": { "$date": "2023-01-24T16:15:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:15:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 68" ], "sightings": 7, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.218.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:33:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:31:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16826, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.24.32.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:34:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:35:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 716, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.207.86.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:36:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:36:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 716, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:36:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:45:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.151.44.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:38:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:39:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 716, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.181.161.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:39:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:21:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6713, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.31.153.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:41:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:41:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 716, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.189.126.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:41:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:23:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1778, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.25.20.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:19:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1244, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.169.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:42:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:25:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 717, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.220.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:44:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:48:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4689, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.204.68.240", "classifications": [], "first_seen": { "$date": "2023-01-24T16:40:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:42:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 24, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "172.104.73.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:47:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:08:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1426, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:47:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:55:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39397, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.12.175", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T16:49:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:21:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 90888, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "181.116.241.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:49:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:50:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1774, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.119.61", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T16:52:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:31:18Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 14922, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.246.208.2", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:53:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:47:27Z" }, "ports": [ 161, 0, 5060 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 4745, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "64.49.124.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:54:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:36:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1422, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.105.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:56:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:57:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 714, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.186.170.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T16:58:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:42:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13757, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.45.154", "classifications": [], "first_seen": { "$date": "2023-01-24T16:48:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T16:48:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.145.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T16:51:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:48:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 50", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 531, "tags": [ "alert", "tcp", "ssh", "brute_force", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "120.155.20.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:00:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:01:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 712, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.65.124.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:01:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:48:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 47" ], "sightings": 725, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "122.117.58.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:03:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:03:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 712, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:04:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:28:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35148, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.162.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:05:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:06:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 712, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:08:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:24:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2318, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.213.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:08:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:54:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1840, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.112.252.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:25:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23674, "tags": [ "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "195.154.48.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:10:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:11:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.18", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T17:10:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:03:57Z" }, "ports": [ 0, 162, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request udp" ], "sightings": 6560, "tags": [ "icmp", "tcp", "snmptrap", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "175.156.86.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:14:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:16:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "(tcp) experimental TCP options found", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1066, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "125.229.177.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:16:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:17:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 710, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.182.67.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:20:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:30:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1078, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.70.34.220", "classifications": [], "first_seen": { "$date": "2023-01-24T17:22:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:22:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 355, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.141.151.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:35:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:18:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30293, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:35:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:23:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1430, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.162.68.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:37:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:38:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 708, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.165.190.34", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T17:38:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:45:52Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 53199, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.236.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:33:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13051, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.162.165.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:40:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.132.122.54", "classifications": [], "first_seen": { "$date": "2023-01-24T17:36:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:38:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 7", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA TCPv4 invalid checksum" ], "sightings": 84, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "212.104.187.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:49:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:50:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 714, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:51:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:51:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 714, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:52:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:04:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1928, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.244.199.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T17:53:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:53:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 714, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.97.176", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T17:54:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:39:28Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 15998, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "118.163.163.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:56:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:07:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12876, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.128", "classifications": [ "Misc activity", "Information Leak", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T17:57:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:14:50Z" }, "ports": [ 5632, 0, 53, 1900 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 27364, "tags": [ "udp", "icmp" ], "rule_count": 8, "classification_count": 4 }, { "ioc": "109.116.232.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:58:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T17:58:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 714, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.203.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T17:59:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:00:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 713, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:00:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:37:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17699, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.250.120.10", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T18:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:06:58Z" }, "ports": [ 0, 161, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 21748, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "59.26.116.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:04:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 712, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.224.163.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:05:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T03:29:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7746, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "108.76.249.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:05:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:47:25Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 3" ], "sightings": 2572, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.154.208.101", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:08:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:55:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 67737, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "118.42.18.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:09:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:10:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 712, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.238", "classifications": [ "Misc activity", "Attempted Information Leak", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-24T18:11:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:59:00Z" }, "ports": [ 0, 177, 1434, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "SQL ping attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 46149, "tags": [ "icmp", "udp", "xdmcp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "198.235.24.60", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T18:13:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:16:34Z" }, "ports": [ 161, 0, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 7990, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.142.125.182", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T18:14:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:38:34Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 122337, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.35.41.56", "classifications": [], "first_seen": { "$date": "2023-01-24T18:06:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:06:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "179.61.197.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:15:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:15:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2130, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.131.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:15:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:15:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 710, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.11.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:16:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:17:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 710, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.134.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:18:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:59:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7715, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.185", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:19:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:03:25Z" }, "ports": [ 161, 0, 53 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 3744, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "143.198.200.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:19:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:12:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2822, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.68.243", "classifications": [], "first_seen": { "$date": "2023-01-24T18:19:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:44:52Z" }, "ports": [ 8081, 8008, 6443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1288, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.189.5.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:19:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:36:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4409, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.12.253.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:21:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:13:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2066, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.125.242.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:21:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:40:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 3123, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.245.192.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:25:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:25:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 710, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:27:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:56:20Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 3320, "tags": [ "icmp", "alert", "tcp", "ssh", "anomaly" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "205.210.31.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:27:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:22:05Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET 3CORESec Poor Reputation IP group 27" ], "sightings": 1722, "tags": [ "icmp", "alert", "tcp", "http" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "61.177.172.61", "classifications": [], "first_seen": { "$date": "2023-01-24T18:17:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:03:05Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET 3CORESec Poor Reputation IP group 40", "ET SCAN Potential SSH Scan", "SSH Login Attempts" ], "sightings": 13147, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "45.79.181.104", "classifications": [], "first_seen": { "$date": "2023-01-24T18:19:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:08:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3824, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.34.196.216", "classifications": [], "first_seen": { "$date": "2023-01-24T18:21:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:21:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 5" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.128.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:35:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:35:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 724, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:38:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:41:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19188, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.71.156.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:43:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:43:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.212.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:43:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T17:09:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21157, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.15.176.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:44:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:39:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1238, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.226.194.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:44:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:32:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4251, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.155.186.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:44:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:44:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.177.172.87", "classifications": [], "first_seen": { "$date": "2023-01-24T18:44:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:48:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 40", "ET SCAN Potential SSH Scan" ], "sightings": 3650, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "34.239.247.9", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:46:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:03:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 39480, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.239.8.32", "classifications": [], "first_seen": { "$date": "2023-01-24T18:46:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:50:48Z" }, "ports": [ 6443, 9443, 3306, 8443, 4443, 3389, 8083, 9000, 993, 8888 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 24765, "tags": [ "tcp", "mysql", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "205.210.31.46", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T18:49:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:00:25Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 721, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "170.39.225.147", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T18:50:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:35:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 70709, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "52.46.145.233", "classifications": [], "first_seen": { "$date": "2023-01-24T18:40:01Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-30T07:17:25Z" }, "ports": [ 33234, 33246, 33260, 33340, 33352, 33386, 33412, 33418, 33448, 33488, 33506, 33554, 33626, 33700, 33716, 33742, 33802, 33842, 33850, 33876, 33884, 33898, 33906, 33966, 34000, 34050, 34070, 34076, 34084, 34100, 34128, 34154, 34172, 34194, 34210, 34216, 34242, 34286, 34300, 51398, 50706, 57532, 56206, 56198, 36372, 54062, 46018, 57672, 43306, 44252, 45190, 52224, 36770, 40986, 34648, 35968, 58394, 60236, 36734, 45002, 48836, 43954, 37816, 34274, 41390, 37496, 53604, 42490, 35456, 47314, 37436, 46578, 42646, 36988, 50052, 44228, 42194, 58986, 38862, 46752, 33466, 34718, 48934, 38400, 48916, 43308, 35632, 60050, 36034, 34016, 48966, 51562, 56792, 37770, 55848, 60152, 55596, 41742, 60048, 59860, 53186, 44134, 59578, 44564, 47570, 48180, 55846, 35942, 42110, 44976, 48528, 60616, 55020, 41142, 54646, 39828, 49656, 51984, 51444, 53148, 60488, 41446, 39742, 59012, 35370, 56244, 45508, 36230, 33038, 36414, 45886, 55308 ], "reporting_nodes": 1, "rules": [], "sightings": 22692, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "62.8.79.2", "classifications": [], "first_seen": { "$date": "2023-01-24T18:46:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:29:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 66" ], "sightings": 34, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.13.187.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:50:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:51:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1367, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.221.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:55:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:57:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17193, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.197.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T18:55:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:47:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1382, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.10.230.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T18:57:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:58:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1366, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "145.239.198.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:00:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:27:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41563, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.72.81.164", "classifications": [], "first_seen": { "$date": "2023-01-24T18:59:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T18:59:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 551, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.144.60.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:00:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:50:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2706, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.208.114", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T19:03:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:29:06Z" }, "ports": [ 0, 53, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "SQL ping attempt" ], "sightings": 4184, "tags": [ "icmp", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "159.203.208.19", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T19:03:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:56:14Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 2648, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.127.44.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T19:03:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:04:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1364, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.255.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:05:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:59:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2664, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.80.79.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T19:11:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T17:57:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2016, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.89.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T19:11:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:47:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1365, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:12:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:58:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1368, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.54.36.185", "classifications": [], "first_seen": { "$date": "2023-01-24T19:01:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:42:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 76" ], "sightings": 580, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.250.31.211", "classifications": [], "first_seen": { "$date": "2023-01-24T19:03:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:03:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 550, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.0.22.2", "classifications": [], "first_seen": { "$date": "2023-01-24T19:06:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:53:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 37", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 850, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "93.157.234.24", "classifications": [], "first_seen": { "$date": "2023-01-24T19:12:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:12:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 550, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "123.241.248.252", "classifications": [], "first_seen": { "$date": "2023-01-24T19:14:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:14:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 550, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "27.130.116.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T19:16:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:16:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1360, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.223.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:17:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:42:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4500, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.158.93.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T19:18:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:19:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1360, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.200.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:23:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:28:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15189, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.205.229", "classifications": [], "first_seen": { "$date": "2023-01-24T19:28:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:28:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 549, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.90.163.249", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T19:31:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:57:35Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 13713, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.147.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:34:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:34:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1358, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.144.152.58", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T19:35:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:39:03Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 14462, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.118.188.244", "classifications": [], "first_seen": { "$date": "2023-01-24T19:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:23:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 58976, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.161.152.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T19:36:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:06:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1936, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.253.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T19:41:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:42:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1358, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.140.181.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T19:42:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:50:41Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1576, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.177.173.61", "classifications": [], "first_seen": { "$date": "2023-01-24T19:38:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:17:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 41", "ET SCAN Potential SSH Scan" ], "sightings": 8866, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "52.119.198.91", "classifications": [], "first_seen": { "$date": "2023-01-24T19:40:03Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-30T03:17:26Z" }, "ports": [ 57056, 57090, 57106, 57112, 57118, 57180, 57206, 57212, 57240, 57248, 57288, 57296, 57308, 57334, 57340, 57362, 57382, 57428, 57456, 57468, 57474, 57482, 57494, 57500, 57506, 57548, 57584, 57608, 57650, 57682, 57706, 57732, 57738, 57774, 57798, 57820, 57826, 57836, 57992, 58000, 58042, 58070, 58094, 58108, 44402, 34376, 59512, 42430, 57896, 39634, 46590, 43176, 60062, 58450, 45650, 44892, 38026, 45956, 56220, 35198, 51426, 47474, 43324, 56582, 60470, 53852, 56918, 35720, 50022, 35510, 43524, 34882, 32844, 55942, 46368, 36554, 45716, 40098, 48814, 39478, 46584, 52020, 51804, 51990, 33160, 53294, 54602, 50128, 58544, 54722, 50120, 47868, 43570, 40234, 47144, 56730, 59194, 48100, 51662, 55102, 48428, 59164, 33470, 40652, 48346, 60128, 42724, 51690, 50438, 42820, 56944, 50696, 43062, 41770, 35566, 39804, 39466, 60852, 33762, 41098, 43170, 37062, 40400, 40104, 47664, 37156, 56166, 39342, 57434, 45370, 47142, 59646, 37952, 51272, 43560, 42896, 57966, 58330, 59464, 57076, 48112, 49650, 50618, 47566, 55398, 54998 ], "reporting_nodes": 1, "rules": [], "sightings": 29446, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "183.221.243.30", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:46:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:42:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 144271, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.197.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:48:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T19:48:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1356, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:51:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11595, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.213.132.151", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T19:52:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:03:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 107975, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "202.158.46.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:52:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:48:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 3617, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:52:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:09:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2997, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "155.94.222.154", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T19:55:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:52:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 63252, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "179.43.171.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:57:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:01:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2698, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.196.59", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:57:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:01:38Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23059, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.206.16", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T19:59:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:07:11Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2750, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.43", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T20:02:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:43:29Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1636, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "163.172.116.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T20:04:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:00:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24979, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.222.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T20:10:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:10:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1356, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.234.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T20:10:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:02:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1382, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T20:10:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:21:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8525, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.172.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T20:11:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:07:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 1832, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.125.188.55", "classifications": [], "first_seen": { "$date": "2023-01-24T20:09:34Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-07-01T13:33:47Z" }, "ports": [ 51644, 51684, 51774, 51854, 51956, 52028, 52560, 52580, 47802, 48710, 53436, 49894, 34744, 56836, 33582, 46350, 39414, 42344, 43912, 45086, 59510, 34102, 50044, 59600, 39410, 57108, 33658, 34980, 36110, 46656, 53646, 54786 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 5608, "tags": [ "tls", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.154.167.171", "classifications": [], "first_seen": { "$date": "2023-01-24T20:13:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:17:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 41487, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "44.205.18.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T20:20:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:44:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 41044, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.132.211.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T20:23:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:24:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1354, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.199.114", "classifications": [], "first_seen": { "$date": "2023-01-24T20:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:17:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 545, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "42.192.145.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T20:33:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:52:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 86741, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.231.6", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T20:35:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:09:37Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 3907, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "220.132.202.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T20:37:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:38:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1352, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.141.32.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T20:39:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:40:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1352, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.209.243.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T20:42:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:42:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1352, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.221.8.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T20:44:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:44:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1352, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.209.132.147", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T20:44:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:05:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 109111, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "61.177.173.56", "classifications": [], "first_seen": { "$date": "2023-01-24T20:31:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:13:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 41", "ET SCAN Potential SSH Scan" ], "sightings": 16972, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "220.72.131.252", "classifications": [], "first_seen": { "$date": "2023-01-24T20:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:35:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1088, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "189.4.93.75", "classifications": [], "first_seen": { "$date": "2023-01-24T20:35:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:39:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3264, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.80.159", "classifications": [], "first_seen": { "$date": "2023-01-24T20:44:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:44:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 53", "ET SCAN Potential SSH Scan" ], "sightings": 3808, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.142.125.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T20:50:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:34:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1953, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.223.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T20:58:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:22:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1364, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.61.186.176", "classifications": [], "first_seen": { "$date": "2023-01-24T20:45:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:45:05Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 34" ], "sightings": 543, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.106.205.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T20:47:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:44:57Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5505, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.206.183", "classifications": [], "first_seen": { "$date": "2023-01-24T20:52:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T20:52:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 543, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.177.173.55", "classifications": [], "first_seen": { "$date": "2023-01-24T20:57:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T14:42:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 41", "ET SCAN Potential SSH Scan", "SSH Login Attempts" ], "sightings": 12827, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "125.229.19.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:10:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:10:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1348, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.120.27.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:10:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:10:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1348, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.229.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T21:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:24:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.133.184.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:09:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:58:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4016, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.113.198.158", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T21:20:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:10:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55904, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.32.223.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:15:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:02:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2901, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.249.12", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T21:30:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:50:08Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 4630, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.112.75.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T21:33:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:26:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6002, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.172.83.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:36:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:07:11Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8760, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.243.132.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:38:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:39:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1344, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.129.95.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:42:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:43:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1344, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.221.227.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:44:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:45:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1343, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "97.101.177.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T21:44:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:44:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1344, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.195.139.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:33:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:33:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2195, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.79.89.217", "classifications": [], "first_seen": { "$date": "2023-01-24T21:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:37:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 540, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "52.46.159.244", "classifications": [], "first_seen": { "$date": "2023-01-24T21:39:57Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-29T17:17:24Z" }, "ports": [ 60940, 60998, 32802, 32814, 32968, 32970, 32992, 32998, 33092, 33214, 33220, 33318, 33368, 33408, 33512, 33572, 33596, 33602, 33622, 33678, 33768, 53284, 46886, 35734, 51602, 53608, 53736, 48240, 60096, 53308, 34062, 56806, 38498, 45448, 55904, 52146, 36334, 55466, 37740, 51552, 53998, 43500, 52256, 60896, 36526, 59944, 36082, 50546, 53958, 51294, 43494, 54528, 60064, 60784, 53680, 43782, 59380, 36060, 51852, 47990, 39678, 52430, 42452, 40968, 54600, 42140, 48772 ], "reporting_nodes": 1, "rules": [], "sightings": 9975, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "24.84.209.236", "classifications": [], "first_seen": { "$date": "2023-01-24T21:42:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:42:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 14" ], "sightings": 1078, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.210.187.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T21:46:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:46:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1342, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.70.110.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:49:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:40:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14033, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.173.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:53:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:55:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1342, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.65.50.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:57:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:57:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1342, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.224.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T21:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:59:16Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2013, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.101.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T21:59:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:59:28Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2013, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "114.35.135.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T21:47:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:01:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6943, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert", "brute_force" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "220.135.62.215", "classifications": [], "first_seen": { "$date": "2023-01-24T21:52:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:52:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 538, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.134.29.80", "classifications": [], "first_seen": { "$date": "2023-01-24T21:59:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T21:59:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1614, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "47.89.92.77", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:00:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:47:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55195, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.76.104.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T22:04:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:07:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2568, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.195.99.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:05:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:05:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1340, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.177.52.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T22:06:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:08:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1340, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.83.135.137", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:39:14Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3733, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "118.113.198.159", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T22:09:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:17:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 69783, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "198.235.24.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:10:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:10:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1340, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.141.157.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T22:13:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:33:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2657, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.181.252.27", "classifications": [], "first_seen": { "$date": "2023-01-24T22:07:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:07:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1611, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.219", "classifications": [], "first_seen": { "$date": "2023-01-24T22:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:10:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 753, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.142.236.35", "classifications": [ "Executable code was detected", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T22:21:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:01:44Z" }, "ports": [ 22, 0, 161 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP public access udp" ], "sightings": 88018, "tags": [ "tcp", "ssh", "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "114.33.114.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T22:28:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:12:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2137, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.177.173.41", "classifications": [], "first_seen": { "$date": "2023-01-24T22:15:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:30:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 41", "ET SCAN Potential SSH Scan", "SSH Login Attempts" ], "sightings": 10912, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "47.89.84.165", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:33:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:47:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54927, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.246.84.62", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:33:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:47:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54553, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.88.43.62", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:34:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:47:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54844, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.246.80.76", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:48:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54894, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.89.132.97", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:48:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.89.71.80", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:48:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54855, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.88.40.57", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:49:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54827, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.204.104.62", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:35:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:41:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54580, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.31", "classifications": [ "Executable code was detected", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-24T22:35:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:02:50Z" }, "ports": [ 22, 1434, 0, 1900 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 38657, "tags": [ "tcp", "ssh", "udp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "47.246.64.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:50:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54801, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.246.92.78", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:50:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54813, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.104.73.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:30:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2650, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.89.85.14", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:51:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54807, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.246.68.13", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:38:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:09:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 90328, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.246.82.77", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:38:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:51:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54876, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.211.35.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:38:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:26:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20491, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.86.66.87", "classifications": [], "first_seen": { "$date": "2023-01-24T22:38:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:38:28Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 666, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "62.128.96.14", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:41:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:46:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54597, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.79.56.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:44:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:44:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1332, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.4.9.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T22:44:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:40:31Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 59", "ET 3CORESec Poor Reputation IP group 40" ], "sightings": 1571, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "52.46.141.158", "classifications": [], "first_seen": { "$date": "2023-01-24T22:39:59Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-30T06:17:23Z" }, "ports": [ 60224, 60232, 60288, 60298, 60304, 60342, 60350, 60376, 60410, 60430, 60498, 60532, 60546, 60558, 60564, 60572, 60578, 60618, 60644, 60678, 60698, 60718, 60746, 60756, 60782, 60788, 60800, 60826, 60902, 60908, 60916, 60944, 60960, 32768, 32774, 32780, 32828, 32844, 32860, 32872, 32940, 32972, 32988, 33012, 33044, 54002, 51666, 33938, 39790, 46070, 39420, 39664, 60888, 47002, 43954, 38436, 37866, 49812, 52266, 42378, 40586, 57522, 56870, 38748, 33940, 35138, 57670, 56770, 47224, 60834, 44550, 56950, 54038, 54276, 38016, 55240, 39474, 52576, 56420, 42068, 35748, 49120, 47406, 52698, 34028, 34848, 40786, 58900, 60602, 38090, 38012, 37068, 34924, 51618, 38244, 59972, 57222, 43400, 49606, 50358, 48682, 44324, 56488, 41992, 55478, 59844, 40402, 42360, 55110, 54614, 44242, 35378, 52802, 60980, 40060, 56118, 37638, 38190, 38170, 54442, 40828, 35884, 48506, 55026, 34358, 48552, 55164, 47556, 56792, 50184, 49964, 55354, 42018, 53544, 54800, 45654, 54452, 49910, 60856, 41920, 40866, 50218, 47902, 43686, 56850, 44482, 54770, 52774, 60424, 42002, 43036, 44928, 51422, 34062, 54124, 42162 ], "reporting_nodes": 1, "rules": [], "sightings": 22095, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "122.117.215.93", "classifications": [], "first_seen": { "$date": "2023-01-24T22:40:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:40:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 535, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.177.172.91", "classifications": [], "first_seen": { "$date": "2023-01-24T22:42:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:02:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 40", "ET SCAN Potential SSH Scan" ], "sightings": 4758, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.126.238.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T22:43:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:43:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 52", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2048, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "95.142.39.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:46:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1330, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.175", "classifications": [ "Executable code was detected", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T22:50:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:59:23Z" }, "ports": [ 22, 0, 161 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 3871, "tags": [ "tcp", "ssh", "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "198.235.24.134", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T22:54:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:05:14Z" }, "ports": [ 0, 22, 53, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "SQL ping attempt" ], "sightings": 42216, "tags": [ "icmp", "tcp", "ssh", "udp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "86.106.90.59", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:57:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:26:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 46862, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.94.138.106", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:57:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:51:24Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9728, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.243.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T22:58:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:58:35Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1995, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.139.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:00:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:26:49Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5194, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "121.149.134.236", "classifications": [], "first_seen": { "$date": "2023-01-24T22:46:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T22:46:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 534, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.222.108.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T22:57:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:59:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2918, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.60.68.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T23:07:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:07:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1328, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.236.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:10:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1328, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.139.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:11:02Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:42:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4736, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.165.91.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T23:13:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:13:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1328, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.141.234.245", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:13:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:13:27Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2656, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.255.9", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:20:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:21:10Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13471, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "146.88.240.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:21:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:20:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12884, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.149.7", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T23:21:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:34:57Z" }, "ports": [ 1900, 0, 5060, 161 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 20065, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "172.105.40.217", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T23:22:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:19:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 250531, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "123.6.49.6", "classifications": [], "first_seen": { "$date": "2023-01-24T23:15:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:17:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "invalid_banner" ], "sightings": 3192, "tags": [ "alert", "tcp", "ssh", "anomaly" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "123.6.49.36", "classifications": [], "first_seen": { "$date": "2023-01-24T23:15:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:15:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "invalid_banner" ], "sightings": 2660, "tags": [ "alert", "tcp", "ssh", "anomaly" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "220.133.190.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:32:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:53:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 51849, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.133", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:34:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:14:20Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72971, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.137.209.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T23:38:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:16:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9917, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.161.225.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T23:39:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:39:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1324, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.252.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T23:40:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:40:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1324, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.82.77.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:40:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:06:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 167771, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.199.221.143", "classifications": [], "first_seen": { "$date": "2023-01-24T23:43:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:43:57Z" }, "ports": [ 51433 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 662, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.116.78.152", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:44:08Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:45:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 19268, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "24.232.173.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T23:47:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:47:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1322, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.133.64.19", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-24T23:47:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:16:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 110053, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "220.134.90.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-24T23:51:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:51:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1322, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.148.98.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:30:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 21100, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "113.57.9.147", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:54:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 29365, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.138.157.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:53:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:53:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2644, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.192.81.134", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-24T23:58:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:40:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 74701, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "183.104.215.10", "classifications": [], "first_seen": { "$date": "2023-01-24T23:55:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-24T23:55:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 530, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "146.19.3.140", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T00:00:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:36:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 114419, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "216.218.206.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:02:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:10:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18947, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.168.75.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:05:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:05:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3300, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "103.141.140.59", "classifications": [], "first_seen": { "$date": "2023-01-25T00:06:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:06:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 1320, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "61.82.205.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:07:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:08:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1320, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.186.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:08:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:08:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3300, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "184.105.247.247", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T00:10:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:01:04Z" }, "ports": [ 0, 177, 1434, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "SQL ping attempt", "(stream_tcp) data on SYN packet" ], "sightings": 46636, "tags": [ "icmp", "udp", "xdmcp", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "211.198.11.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:13:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:14:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1320, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.14.209.226", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:13:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:22:24Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3298, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "175.200.33.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:04:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:04:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1034, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.74.6.226", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:39:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4637, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.32.2.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:19:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:04:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2225, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.73.30.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:23:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:25:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1318, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.95.146.203", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T00:24:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:18:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 85032, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "112.168.206.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:15:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:24:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 1051, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "119.202.64.77", "classifications": [], "first_seen": { "$date": "2023-01-25T00:28:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:29:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1584, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.32.81.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:29:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:29:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1033, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.4.11.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:30:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:30:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1316, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.129.90.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:32:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:32:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "(tcp) experimental TCP options found", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1974, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.112.75.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:32:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:27:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5487, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.4.52.80", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:36:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:36:00Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2632, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "157.230.94.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:36:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:17:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14920, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.13", "classifications": [ "Misc activity", "Information Leak", "Executable code was detected", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T00:39:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:00:29Z" }, "ports": [ 1434, 0, 22, 5632, 1900, 161 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "APP-DETECT PCAnywhere server response", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 25886, "tags": [ "udp", "icmp", "tcp", "ssh", "snmp" ], "rule_count": 11, "classification_count": 5 }, { "ioc": "105.184.50.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:41:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:42:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1316, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.178.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:42:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:59:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14791, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "97.105.69.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:33:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:33:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 91", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2117, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "210.223.94.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:41:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:41:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1765, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.129.39.176", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-25T00:45:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:15:24Z" }, "ports": [ 0, 161, 69, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP public access udp", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP Get", "ET CINS Active Threat Intelligence Poor Reputation IP group 30" ], "sightings": 44546, "tags": [ "icmp", "udp", "snmp", "tftp", "alert", "tcp", "http" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "109.237.98.185", "classifications": [], "first_seen": { "$date": "2023-01-25T00:46:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:32:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 77876, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.127.79.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:47:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:25:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 56" ], "sightings": 1959, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.151.182.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:48:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:41:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2604, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.14.106.206", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T00:48:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 87852, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "65.49.20.122", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-25T00:53:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:48:33Z" }, "ports": [ 0, 69, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "SQL ping attempt" ], "sightings": 11470, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "221.149.167.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:53:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:54:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1314, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.140", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T00:56:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:49:27Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 34028, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "124.63.197.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T00:57:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:58:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1314, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:57:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:07:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2535, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.171.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T00:59:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:49:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21764, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.193.147.186", "classifications": [], "first_seen": { "$date": "2023-01-25T00:49:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:49:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 526, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.177.173.42", "classifications": [], "first_seen": { "$date": "2023-01-25T00:54:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:27:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 41", "ET SCAN Potential SSH Scan" ], "sightings": 7786, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "218.161.7.239", "classifications": [], "first_seen": { "$date": "2023-01-25T00:56:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T00:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 526, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.143", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T01:00:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:24:21Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 16882, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "120.198.71.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:02:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:54:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2596, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.16", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T01:05:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:21:53Z" }, "ports": [ 0, 1434, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "X11 xdmcp info query" ], "sightings": 56635, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.35.126.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:05:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:09:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15324, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:06:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:53:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6312, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:06:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:12:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "73.59.179.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T01:09:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:09:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1312, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.210.38.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:10:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:35:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21657, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:13:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:44:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10958, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.90.212.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:14:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:03:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1960, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.45.113.182", "classifications": [], "first_seen": { "$date": "2023-01-25T01:08:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:01:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1796, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "189.1.82.217", "classifications": [], "first_seen": { "$date": "2023-01-25T01:08:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:09:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 23" ], "sightings": 2100, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "65.49.20.121", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-25T01:09:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:27:56Z" }, "ports": [ 80, 0, 69 ], "reporting_nodes": 3, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 68", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "PROTOCOL-TFTP Get" ], "sightings": 11170, "tags": [ "alert", "tcp", "http", "icmp", "udp", "tftp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "185.125.188.58", "classifications": [], "first_seen": { "$date": "2023-01-25T01:09:33Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-06-30T03:32:57Z" }, "ports": [ 57144, 57300, 57332, 57356, 57476, 57904, 58038, 58084, 58124, 58194, 54198, 44220, 49516, 38826, 47168, 48928, 39234, 49718, 50844, 35578, 33744, 37290, 59188, 58306, 60014, 44120, 35542, 37980, 43902, 36708, 48310, 37222, 44604, 40266 ], "reporting_nodes": 1, "rules": [], "sightings": 5928, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "205.210.31.3", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T01:10:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:13:05Z" }, "ports": [ 80, 53, 0, 1434, 161, 1900, 5632 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "APP-DETECT PCAnywhere server response" ], "sightings": 60957, "tags": [ "alert", "tcp", "http", "udp", "icmp", "snmp" ], "rule_count": 9, "classification_count": 3 }, { "ioc": "2a04:4e42:0078:0000:0000:0000:0000:0561", "classifications": [], "first_seen": { "$date": "2023-01-25T01:13:44Z" }, "ja3": [ "8662467bc96db2d387755570446a7946" ], "last_seen": { "$date": "2023-06-29T11:53:52Z" }, "ports": [ 46214, 46216, 46726, 46728, 46940, 60340, 60352, 50906, 50914, 34886, 34894, 46502, 42992, 45376, 45380, 49084, 49086, 38476, 38480, 55540, 55546, 41838, 41046 ], "reporting_nodes": 1, "rules": [], "sightings": 4017, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.245.53.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:16:35Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:51:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21363, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.163.200.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:17:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:03:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48056, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:19:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:39:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16378, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.115", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T01:20:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:04:01Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 5694, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "211.51.79.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:27:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:29:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9170, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.129.33.99", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T01:28:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:11:28Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 28394, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "104.221.253.70", "classifications": [], "first_seen": { "$date": "2023-01-25T01:22:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:26:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 38227, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "64.62.197.107", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T01:30:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:29:47Z" }, "ports": [ 0, 22, 80, 1900 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 22553, "tags": [ "icmp", "alert", "tcp", "ssh", "Go", "http", "udp" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "209.141.41.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:32:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:13:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 173826, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.44.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:32:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:30:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2490, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.210.104.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:32:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:45:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28663, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:35:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:35:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1308, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.139.199.93", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T01:37:33Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:06:12Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 117", "ET SCAN Potential SSH Scan" ], "sightings": 42696, "tags": [ "icmp", "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "211.105.227.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T01:38:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:39:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1308, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.168", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T01:39:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:52:20Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1323, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.77", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-25T01:39:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:06:06Z" }, "ports": [ 0, 161, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-TFTP Get" ], "sightings": 25096, "tags": [ "icmp", "udp", "snmp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.81", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T01:44:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:34:29Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 24579, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "61.76.147.51", "classifications": [], "first_seen": { "$date": "2023-01-25T01:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:32:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 64" ], "sightings": 1650, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.235.24.145", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-25T01:38:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:24:20Z" }, "ports": [ 80, 53, 0, 22, 5632, 161 ], "reporting_nodes": 3, "rules": [ "ET 3CORESec Poor Reputation IP group 25", "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 32034, "tags": [ "alert", "tcp", "http", "udp", "icmp", "ssh", "ZGrab", "snmp" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "49.213.184.228", "classifications": [], "first_seen": { "$date": "2023-01-25T01:39:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:39:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 41", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1566, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.128.196.246", "classifications": [], "first_seen": { "$date": "2023-01-25T01:42:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:42:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 522, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "150.230.98.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:46:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:29:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1827, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.92.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T01:47:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:48:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1306, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.93.143.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T01:48:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:49:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1306, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.16.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:55:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:45:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13182, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "40.137.99.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T01:56:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:56:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1306, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.22.88", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T01:57:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:23:44Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5105, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.87.19.168", "classifications": [], "first_seen": { "$date": "2023-01-25T01:47:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:14:41Z" }, "ports": [ 45248, 45434, 60036, 47286, 40380, 56098 ], "reporting_nodes": 1, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management" ], "sightings": 14280, "tags": [ "alert", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.187.236.253", "classifications": [], "first_seen": { "$date": "2023-01-25T01:53:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:30:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 750, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.33.195.101", "classifications": [], "first_seen": { "$date": "2023-01-25T01:57:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T01:57:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 521, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.241.152.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:00:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:47:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13907, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.33.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:03:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:22:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10162, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.16.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:03:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:19:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11545, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.202.137.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:10:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:10:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.77.70.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:10:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:35:27Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2777, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.166.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:12:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:23:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1303, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.158.71.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:15:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1303, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.47.58.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:16:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:17:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1302, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.106.125.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:17:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:17:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.43.171.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:17:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:57:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2971, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.251.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:17:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:53:03Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10911, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.126.55.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:21:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:21:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1302, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.71.135.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:27:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:58:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5498, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.59.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:29:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:30:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1301, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.29.233.166", "classifications": [], "first_seen": { "$date": "2023-01-25T02:16:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:26:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1503, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.27.234.184", "classifications": [], "first_seen": { "$date": "2023-01-25T02:16:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:16:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 519, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "118.42.173.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:28:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:28:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1775, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.182.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:32:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:15:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:34:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:03:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17971, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.43.142.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T02:38:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:09:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 5222, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "76.8.60.71", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T02:41:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:35:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 118096, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "184.105.247.206", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T02:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:41:57Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 20234, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.88", "classifications": [ "Misc activity", "Potentially Bad Traffic", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-25T02:45:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:28:40Z" }, "ports": [ 0, 69, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 19630, "tags": [ "icmp", "udp", "tftp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "14.47.185.237", "classifications": [], "first_seen": { "$date": "2023-01-25T02:32:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:32:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 9" ], "sightings": 1554, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.100.87", "classifications": [], "first_seen": { "$date": "2023-01-25T02:41:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:41:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1036, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "117.187.38.151", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:46:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:55:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 72908, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "175.31.201.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:50:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:50:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1298, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.150.100.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:50:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:50:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1298, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.102.49.190", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T02:52:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:47:40Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 17854, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "216.218.206.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:52:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:31:33Z" }, "ports": [ 0, 80 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 1943, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "184.105.247.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T02:57:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:04:14Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 3318, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "216.218.206.103", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-25T02:59:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:05:10Z" }, "ports": [ 0, 69 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 5997, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "14.43.253.118", "classifications": [], "first_seen": { "$date": "2023-01-25T02:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T02:56:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 8" ], "sightings": 517, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.227.68.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:01:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:18:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6034, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.146.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:03:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:37:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6573, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "132.145.120.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:03:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T02:28:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16588, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.130.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:06:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9814, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T01:52:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6219, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:07:16Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 20151, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.90", "classifications": [ "Misc activity", "Decode of an RPC Query", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-25T03:05:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:45:30Z" }, "ports": [ 0, 111, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-TFTP Get" ], "sightings": 23894, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "tftp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "47.240.90.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:07:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:51:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9328, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.160.199.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:11:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:11:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1296, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.126", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T03:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:53:20Z" }, "ports": [ 0, 177, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 2919, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "14.38.149.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:15:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:15:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1296, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "105.184.153.10", "classifications": [], "first_seen": { "$date": "2023-01-25T03:03:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:03:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1548, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "221.159.206.62", "classifications": [], "first_seen": { "$date": "2023-01-25T03:14:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:25:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 526, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "134.209.218.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:27:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14148, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "73.99.156.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:23:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:00:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2148, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.68", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T03:25:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:21:29Z" }, "ports": [ 0, 177, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "(stream_tcp) data on SYN packet" ], "sightings": 12980, "tags": [ "icmp", "udp", "xdmcp", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.94.138.107", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T03:26:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:25:02Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 35372, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.228.29.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:29:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:29:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1292, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:29:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:55:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26862, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.220.207.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:34:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:04:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3098, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.172.30.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:35:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:01:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10915, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:49:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27085, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:40:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:32:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30770, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:41:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:07:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.110.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:41:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:48:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23219, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.146.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:41:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:37:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7874, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:42:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:19:37Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 4331, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "220.85.164.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:43:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:53:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1291, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.38.116.238", "classifications": [], "first_seen": { "$date": "2023-01-25T03:37:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:37:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 514, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "122.117.101.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:38:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:52:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9073, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:45:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:54:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8348, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:46:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T05:31:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29535, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.97.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:50:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:50:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1286, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.132", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T03:51:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:54:08Z" }, "ports": [ 0, 1434, 22, 5632, 161, 53, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "ET DROP Dshield Block Listed Source group 1", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt" ], "sightings": 42584, "tags": [ "icmp", "udp", "alert", "tcp", "ssh", "ZGrab", "snmp", "http" ], "rule_count": 8, "classification_count": 2 }, { "ioc": "104.131.162.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:51:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:38:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6063, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.20", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T03:51:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:15:44Z" }, "ports": [ 0, 22, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 31396, "tags": [ "icmp", "tcp", "ssh", "ZGrab", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "68.183.148.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:51:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:39:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8398, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.74", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:53:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:55:33Z" }, "ports": [ 53, 0, 22 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4008, "tags": [ "udp", "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.238.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:54:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:04:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2414, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.60", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-25T03:58:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:58:07Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1926, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "221.153.108.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:58:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:04:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1285, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.2.230.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T03:45:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T03:45:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 995, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.192.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:01:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:32:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.243.24", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T04:05:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:00:35Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 15245, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.250.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:13:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:54:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2914, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.142.236.34", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T04:13:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:13:27Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 61316, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "152.32.141.88", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:13:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:38:26Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3115, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "175.178.40.24", "classifications": [], "first_seen": { "$date": "2023-01-25T04:12:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:07:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 82277, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "183.61.109.221", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T04:20:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:49:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 100984, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "198.199.96.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:25:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:25:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.110.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:26:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T18:59:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34681, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.200", "classifications": [], "first_seen": { "$date": "2023-01-25T04:22:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T06:02:12Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET CINS Active Threat Intelligence Poor Reputation IP group 85", "ET 3CORESec Poor Reputation IP group 45" ], "sightings": 9453, "tags": [ "alert", "tcp", "http" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "114.33.83.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:30:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:37:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2346, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.0.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:33:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:19:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2513, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.103.238", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:34:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:49:45Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20208, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "77.45.80.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:36:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T04:36:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1280, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.89.174.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:20:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4650, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "108.18.254.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:40:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T04:41:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1278, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.174.136.70", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T04:40:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T04:41:09Z" }, "ports": [ 143, 161, 503 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 1917, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.137", "classifications": [ "Detection of a Network Scan", "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:43:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:26:22Z" }, "ports": [ 1900, 0, 80, 22, 5632 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "APP-DETECT PCAnywhere server response" ], "sightings": 21343, "tags": [ "udp", "icmp", "alert", "tcp", "http", "ssh" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "59.126.114.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:43:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:30:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1851, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.248.88.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:31:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:15:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1543, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.181.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:39:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:32:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2398, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.126.239.151", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T04:49:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T04:49:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 6360, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "153.221.160.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:51:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T04:52:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1272, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.44.83.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:52:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T04:52:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1272, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.76.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:53:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:19:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9026, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.23.57.139", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:53:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:49:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55366, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.82.47.8", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-25T04:55:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:32:32Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23657, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "220.93.239.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T04:58:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T04:59:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1272, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.92.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:01:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:27:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13362, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.179", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:03:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:11:08Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 77274, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.126.164.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T05:07:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:38:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1802, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.100.164.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T05:12:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:31:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2297, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.187.34.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T05:13:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T05:14:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1270, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:19:47Z" }, "ports": [ 0, 80 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 2158, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "170.106.176.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:25:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:13:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18066, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.185.187.29", "classifications": [], "first_seen": { "$date": "2023-01-25T05:24:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T05:24:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1014, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.34.225.187", "classifications": [], "first_seen": { "$date": "2023-01-25T05:25:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T05:25:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 507, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "218.98.6.201", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:31:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:38:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 114479, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.233.169.188", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:32:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:45:23Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3750, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "193.35.18.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:33:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:45:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2518, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.189.176.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T05:41:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T05:41:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1264, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.81.0.190", "classifications": [], "first_seen": { "$date": "2023-01-25T05:33:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:59:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1144, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "91.238.104.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:47:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:07:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2522, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.68.46.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:55:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:58:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6823, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.168.124.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T05:55:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:12:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11471, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.71", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T05:58:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T07:03:33Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 10172, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.133.141.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T05:59:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:00:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1261, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "168.205.0.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T05:59:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:00:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1262, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.19.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T05:47:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T05:47:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1057, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2a05:d018:091c:3200:0c8f:1a06:a2dd:450f", "classifications": [], "first_seen": { "$date": "2023-01-25T05:51:53Z" }, "ja3": [ "fb4726d465c5f28b84cd6d14cedd13a7" ], "last_seen": { "$date": "2023-06-29T18:06:26Z" }, "ports": [ 56168, 56306, 56734, 56900, 33304, 56966, 40540, 36034, 42262 ], "reporting_nodes": 1, "rules": [], "sightings": 1664, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "83.4.127.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:06:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:07:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1260, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.137.206.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T06:08:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:08:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1260, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.47.115.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:11:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:12:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1260, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T06:12:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:07:46Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6786, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.18.160.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:14:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:15:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1259, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.220.192.135", "classifications": [], "first_seen": { "$date": "2023-01-25T06:01:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:18:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 47358, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.5", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.173.157.210", "classifications": [], "first_seen": { "$date": "2023-01-25T06:07:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:26:37Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 96" ], "sightings": 1246, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.79.172.21", "classifications": [], "first_seen": { "$date": "2023-01-25T06:13:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T18:27:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3068, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "170.238.136.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T06:17:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:09:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3730, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.67.189.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T06:18:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:18:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1258, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.80.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T06:19:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:22:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7728, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.178.202.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:26:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:27:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1258, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.154", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:27:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:42:24Z" }, "ports": [ 161, 0, 22, 5632 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "APP-DETECT PCAnywhere server response", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36969, "tags": [ "udp", "snmp", "icmp", "alert", "tcp", "ssh", "ZGrab" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "198.235.24.153", "classifications": [ "Detection of a Network Scan", "Misc activity", "Executable code was detected", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-25T06:28:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:44:09Z" }, "ports": [ 1900, 0, 22, 53, 1434 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "SQL ping attempt" ], "sightings": 48644, "tags": [ "udp", "icmp", "ssh", "tcp" ], "rule_count": 9, "classification_count": 5 }, { "ioc": "134.122.127.155", "classifications": [], "first_seen": { "$date": "2023-01-25T06:23:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:23:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 30" ], "sightings": 503, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.223.212.165", "classifications": [], "first_seen": { "$date": "2023-01-25T06:27:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:31:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 38216, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "82.61.186.185", "classifications": [], "first_seen": { "$date": "2023-01-25T06:29:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:29:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 81" ], "sightings": 1006, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.239.204.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T06:30:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:30:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.46.27.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:31:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:31:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1256, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.192.15.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:35:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:36:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1256, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.172.142.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:37:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:38:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1256, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.108", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-25T06:45:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T17:30:11Z" }, "ports": [ 69, 0, 1434, 80 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 17523, "tags": [ "udp", "tftp", "icmp", "alert", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "198.235.24.144", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:49:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:08:09Z" }, "ports": [ 5632, 0, 53, 161, 22 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8765, "tags": [ "udp", "icmp", "snmp", "tcp", "ssh" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "211.57.67.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:51:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:51:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1252, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.31", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T06:53:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:36:42Z" }, "ports": [ 0, 53, 80, 1434, 5632, 161, 1900 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "ET DROP Dshield Block Listed Source group 1", "SQL ping attempt", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 65380, "tags": [ "icmp", "udp", "alert", "tcp", "http", "snmp" ], "rule_count": 12, "classification_count": 4 }, { "ioc": "205.210.31.161", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-25T06:55:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:23:51Z" }, "ports": [ 0, 22, 53, 161, 1900 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 37694, "tags": [ "icmp", "alert", "tcp", "ssh", "udp", "snmp", "ZGrab" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "170.106.115.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T06:57:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:50:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24441, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.230.144.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:59:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:01:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1251, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.94.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T07:00:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:00:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1251, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.2.104.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T06:49:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T06:49:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 56", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2193, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.95.55.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:00:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:00:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1250, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.102.61.47", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T07:01:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:55:02Z" }, "ports": [ 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 11504, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.226.240.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T07:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:59:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1788, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.117", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:10:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:35:24Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10422, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.134", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T07:13:25Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:11:11Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 23482, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "220.134.100.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T07:15:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:15:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1250, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.239.8.126", "classifications": [], "first_seen": { "$date": "2023-01-25T07:15:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:05:50Z" }, "ports": [ 3389, 993, 50001, 10443, 4443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 20141, "tags": [ "tcp", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.145.201.243", "classifications": [], "first_seen": { "$date": "2023-01-25T07:02:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:04:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1000, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "116.14.1.60", "classifications": [], "first_seen": { "$date": "2023-01-25T07:07:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:07:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 500, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.231.65.237", "classifications": [], "first_seen": { "$date": "2023-01-25T07:08:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:08:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 500, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "64.62.197.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:11:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:01:26Z" }, "ports": [ 22, 0 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET CINS Active Threat Intelligence Poor Reputation IP group 67", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4098, "tags": [ "alert", "tcp", "ssh", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "205.210.31.176", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:15:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:31:19Z" }, "ports": [ 53, 0, 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 30762, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "128.14.209.46", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:19:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:18:47Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15116, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:23:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:33:54Z" }, "ports": [ 0, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET 3CORESec Poor Reputation IP group 27" ], "sightings": 9208, "tags": [ "icmp", "alert", "tcp", "http" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "74.82.47.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:25:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:53:24Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack" ], "sightings": 1770, "tags": [ "icmp", "alert", "tcp", "http" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "58.16.83.237", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:29:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:54:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 94538, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "79.32.203.158", "classifications": [], "first_seen": { "$date": "2023-01-25T07:15:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:15:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 78", "ET 3CORESec Poor Reputation IP group 43" ], "sightings": 1497, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "79.13.190.174", "classifications": [], "first_seen": { "$date": "2023-01-25T07:17:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:18:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1497, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "138.197.204.67", "classifications": [], "first_seen": { "$date": "2023-01-25T07:19:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:37:53Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 12" ], "sightings": 719, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.221.243.24", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T07:33:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:32:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 168066, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "184.105.247.252", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-25T07:37:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:15:03Z" }, "ports": [ 0, 1434, 80, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "(stream_tcp) data on SYN packet", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 32171, "tags": [ "icmp", "udp", "tcp", "http", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "197.189.207.28", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T07:37:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:03:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 69819, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "43.129.36.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:41:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:16:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21292, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:41:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:04:21Z" }, "ports": [ 0, 1434, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 15401, "tags": [ "icmp", "udp", "ssh", "tcp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.126.81.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T07:43:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T07:43:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1244, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.146.30.220", "classifications": [], "first_seen": { "$date": "2023-01-25T07:33:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:05:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 80338, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "220.84.163.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T07:37:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:34:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7026, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.65.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T07:49:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:56:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2076, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.39.225.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T07:54:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:46:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 50315, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.83", "classifications": [ "Misc activity", "Decode of an RPC Query", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-25T07:59:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:10:27Z" }, "ports": [ 0, 80, 111, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-TFTP Get" ], "sightings": 32472, "tags": [ "icmp", "tcp", "http", "udp", "sunrpc", "portmapper", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.152", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T07:54:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:15:43Z" }, "ports": [ 80, 0, 161 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 13888, "tags": [ "alert", "tcp", "http", "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "14.184.99.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:00:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:01:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1240, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.90.79.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:07:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:07:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1240, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.177", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T08:08:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:36:54Z" }, "ports": [ 0, 22, 161, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt" ], "sightings": 32006, "tags": [ "icmp", "tcp", "ssh", "udp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "62.28.216.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:12:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:12:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1240, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.134.74.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:12:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:13:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3720, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.178.35.30", "classifications": [], "first_seen": { "$date": "2023-01-25T08:09:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:12:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 36135, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "198.235.24.9", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T08:19:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:30:40Z" }, "ports": [ 0, 22, 161, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 49237, "tags": [ "icmp", "tcp", "ssh", "udp", "snmp", "ZGrab" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "205.215.24.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:27:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:28:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1238, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.125.134.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:28:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:21:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 3452, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.163.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:28:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:30:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1238, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.86", "classifications": [ "Misc activity", "Decode of an RPC Query", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T08:30:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:45:40Z" }, "ports": [ 0, 111, 1434, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "SQL ping attempt", "X11 xdmcp info query" ], "sightings": 21030, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "xdmcp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "111.162.113.23", "classifications": [], "first_seen": { "$date": "2023-01-25T08:19:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:22:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1976, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "101.206.243.239", "classifications": [], "first_seen": { "$date": "2023-01-25T08:23:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:52:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 1", "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA STREAM FIN out of window" ], "sightings": 34563, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "194.156.155.240", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:32:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:39:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 51277, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.133.60.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:35:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:36:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1236, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.224.146.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:41:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:14:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2835, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.228.131.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:41:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:53:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2341, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.6.188.167", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:47:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:46:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 34869, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.148.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:49:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:49:20Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1851, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "218.98.6.202", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T08:50:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:00:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 60052, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "198.199.118.163", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T08:50:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:33:12Z" }, "ports": [ 5060, 0, 53 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 1860, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "60.250.68.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:51:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:37:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 61" ], "sightings": 3967, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.143.214.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:56:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:42:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3087, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.213.220.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:56:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:46:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1800, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.147.92.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T08:59:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:59:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1234, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.37.203.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:28:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 4", "ET 3CORESec Poor Reputation IP group 25" ], "sightings": 2485, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "58.205.208.220", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:00:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:03:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 63687, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.147", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T08:49:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:47:23Z" }, "ports": [ 80, 161, 0, 1434, 53, 22, 1900, 5632 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt", "APP-DETECT PCAnywhere server response", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52941, "tags": [ "alert", "tcp", "http", "udp", "snmp", "icmp", "ssh", "ZGrab" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "118.195.182.65", "classifications": [], "first_seen": { "$date": "2023-01-25T08:49:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:05:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 45252, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "193.142.146.221", "classifications": [], "first_seen": { "$date": "2023-01-25T08:51:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T08:51:19Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 492, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "120.201.53.108", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:01:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:54:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 53059, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "118.152.154.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:05:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:06:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1742, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.11", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:06:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:37:02Z" }, "ports": [ 0, 53, 5632, 22, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 57661, "tags": [ "icmp", "udp", "tcp", "ssh", "snmp", "ZGrab" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "220.133.142.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:07:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:08:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1232, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.212.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:11:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:15:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11350, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.2.93.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:13:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1232, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.110.167.100", "classifications": [], "first_seen": { "$date": "2023-01-25T09:12:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:12:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 491, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.226.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:24:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:24:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1230, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:26:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:26:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1230, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.89.65.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:27:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:27:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1230, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.15.151.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:29:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:30:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18027, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.120.34", "classifications": [], "first_seen": { "$date": "2023-01-25T09:22:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:22:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 490, "tags": [ "ssh", "tcp", "ssh", "Go", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "140.246.144.28", "classifications": [], "first_seen": { "$date": "2023-01-25T09:29:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:45:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 40655, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "37.53.74.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:31:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:31:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3070, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "205.210.31.9", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-25T09:32:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:03:50Z" }, "ports": [ 5632, 0, 1900, 80, 53, 1434, 161 ], "reporting_nodes": 3, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 63618, "tags": [ "udp", "icmp", "alert", "tcp", "http", "snmp" ], "rule_count": 12, "classification_count": 4 }, { "ioc": "198.235.24.159", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T09:37:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:38:25Z" }, "ports": [ 0, 53, 5632, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 11082, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "89.248.172.16", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-25T09:42:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:40:52Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP NULL command attempt" ], "sightings": 6758, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.11", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T09:42:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:27:02Z" }, "ports": [ 0, 1900, 22, 53, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "ET DROP Dshield Block Listed Source group 1", "ET 3CORESec Poor Reputation IP group 27", "PROTOCOL-DNS named version attempt", "SQL ping attempt" ], "sightings": 69956, "tags": [ "icmp", "udp", "alert", "tcp", "ssh", "ZGrab" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "111.253.134.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:42:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:43:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1228, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.105.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:43:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1228, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.215.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:44:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:45:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 51" ], "sightings": 1230, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "189.38.131.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:46:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:46:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1226, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.19.191.28", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T09:46:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:07:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 44162, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "45.126.112.36", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T09:49:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:48:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 39737, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.127.63.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:49:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:51:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1226, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.90.224.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T09:52:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:04:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2142, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.78", "classifications": [ "Decode of an RPC Query", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T09:55:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:37:33Z" }, "ports": [ 111, 0, 177, 80 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 11811, "tags": [ "udp", "sunrpc", "portmapper", "icmp", "xdmcp", "alert", "tcp", "http" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "118.220.31.109", "classifications": [], "first_seen": { "$date": "2023-01-25T09:55:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:55:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 488, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.33.126.55", "classifications": [], "first_seen": { "$date": "2023-01-25T09:59:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T09:59:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 976, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "190.213.129.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T10:03:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:59:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43085, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.224.199.59", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T10:04:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:43:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 86954, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "74.82.47.22", "classifications": [ "Attempted Information Leak", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-25T10:04:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:03:03Z" }, "ports": [ 161, 0, 111 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 9849, "tags": [ "udp", "snmp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "74.82.47.34", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:20:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:05:30Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17842, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "61.177.172.114", "classifications": [], "first_seen": { "$date": "2023-01-25T10:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) server version string overflow" ], "sightings": 610, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.135.195.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T10:28:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:29:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1220, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.225.3.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T10:29:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:29:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1220, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.75.34.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:29:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:29:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1220, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.167.208.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:35:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:35:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1218, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.88.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T10:37:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:37:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1217, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.189.94.4", "classifications": [], "first_seen": { "$date": "2023-01-25T10:39:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:11:08Z" }, "ports": [ 55473, 38771, 51024, 39938, 44026, 35579, 48467, 51187, 49299, 60643, 40142, 58553, 60712, 38074, 54474, 34494, 52987, 38065, 41321, 50112, 60655, 56983, 42636, 51475, 43206, 33794, 54039, 55563, 58593, 34276, 57985, 53121, 58920, 48067, 47244, 51870, 36039, 48057, 37658, 33407, 57550, 37075, 46185, 33995, 46386, 53067 ], "reporting_nodes": 2, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 37027, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "203.204.230.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:41:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1216, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.140.219.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T10:41:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:08:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1780, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.228.128.102", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:43:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:43:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.229.113.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T10:31:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:31:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1706, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "210.61.156.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T10:42:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:08:36Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7082, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.142", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:48:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:56:09Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3035, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.213.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:56:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:40:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20086, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.223.203.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:56:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:46:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5078, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.134.23.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:57:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:02:41Z" }, "ports": [ 5060, 0, 5100, 5065 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26388, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "84.242.124.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T10:59:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:43:22Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 183", "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 11594, "tags": [ "icmp", "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "61.223.16.124", "classifications": [], "first_seen": { "$date": "2023-01-25T10:47:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T10:47:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 484, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "39.45.37.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T11:07:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:08:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1212, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.144.13", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T11:12:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:50:35Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 22812, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.208.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:12:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:06:21Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 16570, "tags": [ "icmp", "alert", "tcp", "ssh", "anomaly" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "107.170.226.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:22:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:07:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13174, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.248.168.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T11:24:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:26:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1689, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.34.42.51", "classifications": [], "first_seen": { "$date": "2023-01-25T11:20:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T00:21:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 7" ], "sightings": 1318, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.163.60.33", "classifications": [], "first_seen": { "$date": "2023-01-25T11:23:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:23:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 4" ], "sightings": 1446, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "119.194.31.115", "classifications": [], "first_seen": { "$date": "2023-01-25T11:24:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:24:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 482, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.32.230.81", "classifications": [], "first_seen": { "$date": "2023-01-25T11:25:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:25:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 482, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.183", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T11:30:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:30:17Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 63737, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.136.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:32:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:10:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3932, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.40.130.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:36:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:36:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1208, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.161.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T11:36:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:37:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1208, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.105.3.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T11:37:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:37:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1208, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.192.93.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T11:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:31:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 28" ], "sightings": 2329, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.116.79.50", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:41:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:00:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 79122, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "159.203.224.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:43:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:43:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1208, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.230.21", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:45:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:06:26Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15732, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.117.95.114", "classifications": [], "first_seen": { "$date": "2023-01-25T11:44:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:44:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 481, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "46.231.34.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T11:45:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:46:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1206, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.23.247.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T11:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:48:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1206, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.61.109.222", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:48:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:00:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 99089, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.106.174.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:48:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T03:05:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33157, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.56.248.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T11:49:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1206, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.147.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:55:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:54:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2178, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.223.154.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T11:59:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:59:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1206, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.124.202.193", "classifications": [], "first_seen": { "$date": "2023-01-25T11:56:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T11:56:45Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 48" ], "sightings": 480, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.204.208.193", "classifications": [], "first_seen": { "$date": "2023-01-25T12:00:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:00:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 480, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "112.163.225.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T12:04:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:23:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1763, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.168.106.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T12:04:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:01:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1846, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.226.17", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T12:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:19:24Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 3159, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.237.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:05:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:54:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2402, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.231.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:13:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:33:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3206, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.227.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:15:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:30:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5660, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.18.73", "classifications": [], "first_seen": { "$date": "2023-01-25T12:04:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:04:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 51", "ET 3CORESec Poor Reputation IP group 39", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1916, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "121.184.138.195", "classifications": [], "first_seen": { "$date": "2023-01-25T12:09:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:09:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 479, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.79.181.251", "classifications": [], "first_seen": { "$date": "2023-01-25T12:12:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:14:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4375, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "77.91.75.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:15:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:26:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7498, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.14.209.242", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:22:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:29:40Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3005, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "220.132.60.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T12:31:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:42:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2084, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.56.133.207", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:31:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:31:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.229.90.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T12:34:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:31:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11640, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.118.131.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:51:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:51:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 1198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.83.29.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:54:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:21:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.244.230.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T12:55:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:33:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 87" ], "sightings": 1625, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.151.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:56:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:57:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1484, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.232.25", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-25T12:56:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:58:58Z" }, "ports": [ 0, 161, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ET CINS Active Threat Intelligence Poor Reputation IP group 73", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 29160, "tags": [ "icmp", "udp", "snmp", "alert", "tcp", "http" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "114.33.91.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T12:57:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:58:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1198, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.206.119.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T12:58:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T12:59:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1198, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.191.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T12:59:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:56:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2338, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.121.231", "classifications": [], "first_seen": { "$date": "2023-01-25T12:50:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:06:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA STREAM Last ACK with wrong seq" ], "sightings": 43786, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "198.199.116.56", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T13:01:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:47:44Z" }, "ports": [ 0, 161, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "(sip) content length mismatch" ], "sightings": 30342, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "112.163.17.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T13:02:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:03:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1194, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.184.248.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T13:07:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:58:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37015, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.126.158.38", "classifications": [], "first_seen": { "$date": "2023-01-25T13:01:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:06:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 38950, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "59.126.140.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T13:21:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:21:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1192, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.114.51.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T13:21:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:08:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1974, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.45.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T13:21:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:59:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2380, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.26.106.64", "classifications": [], "first_seen": { "$date": "2023-01-25T13:26:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:55:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 16433, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "92.217.25.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T13:26:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:26:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1192, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.111.16.92", "classifications": [], "first_seen": { "$date": "2023-01-25T13:25:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:15:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2109, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.241.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T13:40:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:04:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17098, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.3.163.47", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T13:42:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:24:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 77279, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.212.210.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T13:43:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:43:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "(tcp) experimental TCP options found", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1785, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.248.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T13:44:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:14:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18932, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.22.216", "classifications": [], "first_seen": { "$date": "2023-01-25T13:41:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:41:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 55", "ET 3CORESec Poor Reputation IP group 39" ], "sightings": 1419, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "73.2.127.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T13:50:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:51:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1188, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.107.195.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T13:51:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:15:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1691, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.42.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T13:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:01:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1187, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.113.126", "classifications": [], "first_seen": { "$date": "2023-01-25T13:56:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:56:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 10", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1416, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "122.117.91.252", "classifications": [], "first_seen": { "$date": "2023-01-25T13:57:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T13:57:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 472, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.199.114.229", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:01:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:01:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13934, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.85.7.137", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T14:03:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:16:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 51778, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.243.143.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:05:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:10:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3903, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.105.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:07:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:32:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11718, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.2.5.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:07:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:45:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15406, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.92.190", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T14:09:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:53:24Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 12714, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.218.24", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T14:12:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:53:57Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 2804, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "73.12.85.31", "classifications": [], "first_seen": { "$date": "2023-01-25T14:06:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:06:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 471, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "191.180.180.99", "classifications": [], "first_seen": { "$date": "2023-01-25T14:09:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:09:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 471, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "112.206.213.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:16:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:16:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1184, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.214.130.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:19:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "125.137.93.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T14:24:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:24:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1184, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.74.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:26:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:34:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2254, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.248.93", "classifications": [], "first_seen": { "$date": "2023-01-25T14:22:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:13:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 863, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "113.108.79.9", "classifications": [], "first_seen": { "$date": "2023-01-25T14:24:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:09:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2819, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.80.126.151", "classifications": [], "first_seen": { "$date": "2023-01-25T14:40:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:40:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 64", "ET 3CORESec Poor Reputation IP group 41" ], "sightings": 1404, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.101.226.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:50:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:37:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33596, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.110", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T14:53:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:06:30Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 33330, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "111.62.228.171", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:55:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:51:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 41822, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.202.30", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:55:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:55:24Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1767, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "202.150.153.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T14:57:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:34:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 57568, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.78.1.202", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T14:59:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:29:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 91173, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "170.187.229.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:00:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:23:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6263, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.208.69.251", "classifications": [], "first_seen": { "$date": "2023-01-25T14:48:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:48:30Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 13" ], "sightings": 467, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.130.179.216", "classifications": [], "first_seen": { "$date": "2023-01-25T14:58:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:58:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 467, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "200.233.207.218", "classifications": [], "first_seen": { "$date": "2023-01-25T14:58:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T14:58:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 467, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.203.84.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:01:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:06:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7687, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.116.79.49", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T15:01:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:15:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 140911, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.243.143.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:01:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:14:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.39.50.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:08:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:42:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12128, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.154.28", "classifications": [], "first_seen": { "$date": "2023-01-25T15:14:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T15:14:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 54" ], "sightings": 932, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "172.104.72.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:23:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:07:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2332, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.247.19", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T15:25:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:09:17Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 14880, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.170", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:27:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:46:48Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17770, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "106.42.234.198", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T15:34:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:07:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 102956, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "220.132.248.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T15:36:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:30:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1174, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "67.176.89.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T15:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T15:42:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1172, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.235.19", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T15:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:02:30Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 18997, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.150.112.182", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:45:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:16:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40977, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "39.51.238.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:52:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T15:52:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1170, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.144.213.78", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:55:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:03:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36376, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.187.179.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T15:58:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:59:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2273, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.187.88.37", "classifications": [], "first_seen": { "$date": "2023-01-25T15:58:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:01:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 26" ], "sightings": 925, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.33.108.101", "classifications": [], "first_seen": { "$date": "2023-01-25T15:59:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T15:59:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 463, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "213.74.173.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T16:14:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:38:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.99.176.216", "classifications": [], "first_seen": { "$date": "2023-01-25T16:06:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:06:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 462, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.84.65.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T16:16:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:17:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1166, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.48.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T16:19:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:19:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.60.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T16:20:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:20:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1166, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.139.165", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T16:20:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:31:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 77236, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.82.146.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T16:21:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:21:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1166, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.102.7.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T16:27:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:27:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.19", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T16:27:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:53:04Z" }, "ports": [ 0, 1434, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP request udp" ], "sightings": 5896, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.79.51.42", "classifications": [], "first_seen": { "$date": "2023-01-25T16:36:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:06Z" }, "ports": [ 43811, 42015 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 824, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.161.214.119", "classifications": [], "first_seen": { "$date": "2023-01-25T16:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:31:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 460, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "213.54.155.39", "classifications": [], "first_seen": { "$date": "2023-01-25T16:41:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:41:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 920, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.44.255.131", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T16:55:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:27:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 63509, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "125.140.246.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T16:56:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T16:56:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 10", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1887, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "183.6.98.41", "classifications": [], "first_seen": { "$date": "2023-01-25T16:59:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:38:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum" ], "sightings": 9579, "tags": [ "ssh", "tcp", "ssh", "Go", "ssh", "alert" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "23.236.126.215", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:07:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:00:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 24525, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.236.36.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:11:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:27:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2314, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.149.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T17:03:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:03:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 50", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1496, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "61.177.173.43", "classifications": [], "first_seen": { "$date": "2023-01-25T17:11:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 41", "ET SCAN Potential SSH Scan", "SSH Login Attempts" ], "sightings": 9546, "tags": [ "alert", "tcp", "ssh", "PuTTY", "brute_force" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "122.116.29.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T17:18:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:34:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1808, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.156.155.4", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T17:20:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:25:36Z" }, "ports": [ 56096, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 1709, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.171.125.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:22:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:22:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2890, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "175.100.177.171", "classifications": [], "first_seen": { "$date": "2023-01-25T17:29:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:05:16Z" }, "ports": [ 61863, 63425, 26607, 30607, 19900, 45352, 51690 ], "reporting_nodes": 2, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 3904, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.164.131.5", "classifications": [], "first_seen": { "$date": "2023-01-25T17:15:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:15:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 33" ], "sightings": 457, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "171.61.56.203", "classifications": [], "first_seen": { "$date": "2023-01-25T17:22:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:22:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1828, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "115.188.164.239", "classifications": [], "first_seen": { "$date": "2023-01-25T17:25:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:25:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 457, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.11.207.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T17:27:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:59:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 47", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1232, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "132.147.43.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T17:28:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:28:15Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2162, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.35.53.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:38:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:49:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1804, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.68.129", "classifications": [], "first_seen": { "$date": "2023-01-25T17:40:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:46:32Z" }, "ports": [ 9443, 8088, 8443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1127, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.231.234.131", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:43:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:02:17Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3456, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "106.42.234.199", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:46:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:07:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 53842, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.15.102.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:47:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:47:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.227.111.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T17:48:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:48:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1152, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.210.222.143", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:52:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:11:32Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3450, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.50.148.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T17:55:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:56:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1152, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.24.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T17:56:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:46:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2294, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.0.142", "classifications": [], "first_seen": { "$date": "2023-01-25T17:50:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T17:50:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 455, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "106.248.255.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T18:01:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:02:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1149, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.94.34", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T18:05:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:05:18Z" }, "ports": [ 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp" ], "sightings": 574, "tags": [ "tcp", "snmptrap" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.197.13", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:05:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:51:17Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1734, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "222.186.170.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:06:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:43:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:07:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:22:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2249, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.253.65.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:08:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:08:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1148, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.12.116.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:14:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:59:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 114218, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.229.131.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T18:15:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:42:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1437, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.152.104.210", "classifications": [], "first_seen": { "$date": "2023-01-25T18:11:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:11:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 454, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "73.54.198.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T18:18:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:18:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1146, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.11.46", "classifications": [], "first_seen": { "$date": "2023-01-25T18:15:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:13:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 18", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 5395, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "222.77.179.161", "classifications": [], "first_seen": { "$date": "2023-01-25T18:18:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:36:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA TCPv4 invalid checksum" ], "sightings": 21039, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "124.226.138.230", "classifications": [], "first_seen": { "$date": "2023-01-25T18:20:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:20:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 453, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "161.142.208.6", "classifications": [], "first_seen": { "$date": "2023-01-25T18:22:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T18:22:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 453, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.11.105.143", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:33:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:04:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 51901, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.42", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T18:39:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:17:01Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 20102, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "220.135.98.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T18:39:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T18:13:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1145, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.179.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:47:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:52:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2218, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:56:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:59:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22383, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T18:58:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:25:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31694, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.208.103.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:00:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:16:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14394, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.53", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:00:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:36:22Z" }, "ports": [ 53, 0, 22 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25552, "tags": [ "udp", "icmp", "ssh", "tcp", "ZGrab" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.202.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:01:40Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:23:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3114, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.196.232.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T19:03:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:37:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2339, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.209.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:13:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:13:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1138, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.58.198.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:14:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:14:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1138, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.185.129.203", "classifications": [], "first_seen": { "$date": "2023-01-25T19:08:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:08:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 450, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.241.224.23", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T19:15:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:32:08Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 8328, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.110.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:16:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:12:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11430, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.97", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T19:16:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:55:36Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 40366, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "77.234.118.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:21:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:27:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16735, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.137.46.18", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T19:21:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:04:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 105962, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "1.2.3.4", "classifications": [], "first_seen": { "$date": "2023-01-25T19:25:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:25:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 568, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "191.47.252.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T19:28:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:28:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1136, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.193.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:28:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:44:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19956, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.150.190.96", "classifications": [], "first_seen": { "$date": "2023-01-25T19:17:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:10:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 33", "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 41836, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 7, "classification_count": 0 }, { "ioc": "198.235.24.46", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T19:17:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:41:49Z" }, "ports": [ 22, 0, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 44553, "tags": [ "ssh", "tcp", "ssh", "ZGrab", "ssh", "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "211.185.212.124", "classifications": [], "first_seen": { "$date": "2023-01-25T19:23:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:23:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 449, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.255.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:27:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:36:05Z" }, "ports": [ 22, 5060, 0 ], "reporting_nodes": 2, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 916, "tags": [ "alert", "tcp", "ssh", "Go", "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "83.135.41.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:33:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:04:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28213, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.118.63", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T19:41:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:58:50Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 7180, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.216.11", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T19:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:32:09Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 1396, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "114.35.41.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T19:48:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:49:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1132, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.136.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:53:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T12:23:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.174.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:55:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:06:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6845, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.206.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:55:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:55:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.74.90.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T19:56:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:56:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1132, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.126.81.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T19:57:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:47:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11346, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.16", "classifications": [ "Misc activity", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:00:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:06:34Z" }, "ports": [ 0, 22, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18059, "tags": [ "icmp", "ssh", "tcp", "udp", "ZGrab" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "59.1.249.155", "classifications": [], "first_seen": { "$date": "2023-01-25T19:52:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T19:52:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 47" ], "sightings": 447, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.210.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:04:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:14:20Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 12081, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "49.161.52.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:05:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:25:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 40" ], "sightings": 1244, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "172.104.72.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:07:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:51:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2252, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:07:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:34:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19362, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.85.205.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:11:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:12:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1130, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.109.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:13:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:06:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2976, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.144.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:14:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:16:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1129, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.7", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:20:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:11:37Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6652, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.131.68.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:22:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:22:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.110.72", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:26:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:57:01Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 7398, "tags": [ "udp", "snmp", "icmp", "tcp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.118.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:28:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:46:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1454, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.14.68.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:30:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:56:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1661, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.221.204.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:30:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:31:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1127, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.146.30.163", "classifications": [], "first_seen": { "$date": "2023-01-25T20:20:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:12:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 21", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA TCPv4 invalid checksum" ], "sightings": 54054, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 7, "classification_count": 0 }, { "ioc": "220.132.206.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:29:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:29:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1435, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "161.35.42.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:39:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1126, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.216.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:15:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1134, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.17.99.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:40:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1689, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.135.116.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:32:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:55:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6278, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.94.206", "classifications": [], "first_seen": { "$date": "2023-01-25T20:33:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:33:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 444, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.32.135.139", "classifications": [], "first_seen": { "$date": "2023-01-25T20:40:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:40:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 5", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1332, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.20.6.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:49:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:49:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1122, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.248.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T20:51:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:51:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1122, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.30", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T20:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:27:28Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 13628, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "1.36.126.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T20:54:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T20:54:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1122, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.235.25", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T20:58:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:57:06Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 2065, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.193.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:00:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:39:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9588, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.236.103.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:00:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:30:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 64674, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.238.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:08:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:50:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16886, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.220.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:09:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:21:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10224, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.166.109.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:10:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:10:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1120, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.155", "classifications": [ "Misc activity", "Detection of a Network Scan", "Executable code was detected", "Information Leak" ], "first_seen": { "$date": "2023-01-25T21:11:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:19:16Z" }, "ports": [ 0, 1900, 5632, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "APP-DETECT PCAnywhere server response", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 53622, "tags": [ "icmp", "udp", "tcp", "ssh" ], "rule_count": 8, "classification_count": 4 }, { "ioc": "162.243.133.17", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T21:13:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:19:52Z" }, "ports": [ 0, 161, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP trap tcp" ], "sightings": 2755, "tags": [ "icmp", "udp", "snmp", "tcp", "snmptrap" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "159.203.208.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:14:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:14:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1120, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.5", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T21:17:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:44:34Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 6584, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.235.24.143", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T21:18:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:30:16Z" }, "ports": [ 161, 0, 53, 22 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 59601, "tags": [ "udp", "snmp", "icmp", "tcp", "ssh" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "107.189.11.202", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-25T21:22:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:31:21Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 5522, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.223.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:24:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:24:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.211.13", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T21:24:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:38:40Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 5255, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "211.250.20.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T21:24:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T21:13:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12279, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.209.59.230", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T21:26:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:19:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 209324, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "170.187.226.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:27:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T04:35:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2170, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.192.107.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T21:28:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:29:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1118, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.135.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:29:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:29:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.201.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T22:04:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15190, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.45.232.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T21:34:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:34:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2297, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.208.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:45:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:18:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4624, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.114.37.28", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:45:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:25:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 47618, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.242.5.46", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T21:52:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:56:29Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 15270, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.241.20", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T21:52:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:19:58Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 5722, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.239.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:54:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:40:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8640, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.94.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:57:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:42:20Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 16491, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "116.211.239.113", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T21:57:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:47:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 47673, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "192.241.209.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:58:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T21:58:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1114, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.216.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T21:59:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:47:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3472, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.213.137.21", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:01:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:41:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 70681, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.132.245.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:06:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:07:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1112, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.155.223.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:10:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:25:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1113, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.114.225.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:13:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:13:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1112, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.185.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:13:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:13:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1112, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "96.85.170.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:18:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:51:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 1876, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "61.81.158.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:20:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:56:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 64" ], "sightings": 2116, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "114.35.114.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:20:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:20:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1110, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.126.25.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:22:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:22:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1110, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.153.167.179", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:22:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 88484, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.220.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:23:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:23:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1110, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.206.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:24:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:34:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1376, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.148.11.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:28:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:09:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3145, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.218.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:29:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:29:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1110, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.20.42.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:29:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:29:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7770, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.173.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:29:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:50:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2216, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.63", "classifications": [], "first_seen": { "$date": "2023-01-25T22:23:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:23:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 874, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.55.0.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:32:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:32:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1108, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.245.21", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T22:33:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:39:32Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 5128, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "92.63.196.132", "classifications": [], "first_seen": { "$date": "2023-01-25T22:35:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:36:52Z" }, "ports": [ 11314, 50411 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1108, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "205.210.31.21", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-25T22:36:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:11:05Z" }, "ports": [ 0, 80, 5632, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "APP-DETECT PCAnywhere server response", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 61777, "tags": [ "icmp", "alert", "tcp", "http", "udp", "ssh", "ZGrab" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "189.51.164.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:37:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:37:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1108, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.138", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan", "Information Leak" ], "first_seen": { "$date": "2023-01-25T22:37:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:00:41Z" }, "ports": [ 53, 0, 22, 1900, 161, 1434 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 53528, "tags": [ "udp", "icmp", "alert", "tcp", "ssh", "ZGrab", "snmp" ], "rule_count": 11, "classification_count": 4 }, { "ioc": "51.159.181.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:39:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:58:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2214, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.111.56.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T22:40:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:40:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1108, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.15.43.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:40:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:42:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2216, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:42:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:52:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.133.10", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T22:42:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:55:58Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 1873, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.219.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:48:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:45:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.158.244.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:50:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:55:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2212, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:54:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:20:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21905, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.27.195.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:54:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T22:54:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1106, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.238.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T22:58:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:14:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6694, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.106.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:00:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:05:58Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1669, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "104.236.128.11", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-25T23:01:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:20:02Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 5232, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "198.199.119.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:03:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:24:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6280, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.138.51.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:07:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:09:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6313, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.106.199.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T23:09:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:11:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1104, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.150.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:14:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:32:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5076, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.71.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T23:21:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:21:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2348, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.134.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T23:24:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:24:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1102, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.252.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:29:40Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:47:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.245.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:30:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:42:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6656, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.202.74.37", "classifications": [], "first_seen": { "$date": "2023-01-25T23:16:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:58:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 51699, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "162.142.125.212", "classifications": [], "first_seen": { "$date": "2023-01-25T23:17:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:17:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 433, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "2a05:d018:091c:3200:d8b6:37bc:63f9:703c", "classifications": [], "first_seen": { "$date": "2023-01-25T23:24:27Z" }, "ja3": [ "fb4726d465c5f28b84cd6d14cedd13a7" ], "last_seen": { "$date": "2023-06-29T06:45:21Z" }, "ports": [ 47574, 47728, 48404, 32822, 47162, 50346, 33856 ], "reporting_nodes": 1, "rules": [], "sightings": 1451, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "87.236.176.30", "classifications": [], "first_seen": { "$date": "2023-01-25T23:32:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:32:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 550, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "102.130.49.150", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:43:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:00:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44296, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "138.68.208.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:44:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:44:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1100, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:45:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1100, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.228.162.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:48:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:58:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.14.12.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T23:49:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:49:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1098, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.171.139.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-25T23:50:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:50:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1098, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:55:56Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:41:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1694, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.139.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-25T23:58:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:26:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19531, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.149.255.15", "classifications": [], "first_seen": { "$date": "2023-01-25T23:56:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-25T23:56:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 431, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "94.158.80.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:05:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T04:56:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.223.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T00:08:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:09:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1096, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:12:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:34:27Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 5479, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.175.88.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:13:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1096, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.188", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T00:13:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:20:15Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 101189, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.186.116.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T00:03:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:00:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3204, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.70.21.141", "classifications": [], "first_seen": { "$date": "2023-01-26T00:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:06:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17" ], "sightings": 430, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.172.148.206", "classifications": [], "first_seen": { "$date": "2023-01-26T00:11:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:24:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 17" ], "sightings": 836, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.142.169.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:15:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:15:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1094, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:17:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:24:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5693, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.221.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:17:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:09:42Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 16936, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "175.213.138.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T00:23:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:24:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1094, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "150.116.101.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T00:24:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:24:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1093, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.142.36.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T00:29:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:52:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13175, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.155.90.220", "classifications": [], "first_seen": { "$date": "2023-01-26T00:21:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:27:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "(stream_tcp) TCP timestamp is outside of PAWS window", "ET SCAN Potential SSH Scan" ], "sightings": 6719, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "103.159.251.249", "classifications": [], "first_seen": { "$date": "2023-01-26T00:22:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:56:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 5567, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "65.49.20.96", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-26T00:33:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:28:40Z" }, "ports": [ 1434, 0, 177, 1900 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 18343, "tags": [ "udp", "icmp", "xdmcp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "94.158.80.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:34:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:01:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8516, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.240.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:40:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:07:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1106, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.242.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:40:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:15:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 65685, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.10.227.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T00:41:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:41:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1090, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.33.60.56", "classifications": [], "first_seen": { "$date": "2023-01-26T00:39:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:39:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 428, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "119.196.138.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:49:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:49:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1088, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:53:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:54:55Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 2004, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "65.49.20.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T00:55:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:43:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19064, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.89.28", "classifications": [], "first_seen": { "$date": "2023-01-26T00:52:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T00:52:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 427, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.131.144.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:02:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:29:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11617, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.153.206.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T01:17:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:17:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1082, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.156", "classifications": [ "Misc activity", "Information Leak", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T01:17:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:33:32Z" }, "ports": [ 5632, 0, 22, 161 ], "reporting_nodes": 3, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 17971, "tags": [ "udp", "icmp", "ssh", "tcp", "snmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "192.53.170.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:18:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:34:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2162, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.238.111.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:20:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1082, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.199.238.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:25:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:25:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1082, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:23:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:56:28Z" }, "ports": [ 22, 5060, 0 ], "reporting_nodes": 2, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9805, "tags": [ "alert", "tcp", "ssh", "Go", "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "64.62.197.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:34:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:19:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15192, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:36:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:50:42Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 38711, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "217.182.232.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:40:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:40:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.126", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T01:43:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:54:45Z" }, "ports": [ 69, 0, 177, 80 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "(stream_tcp) data on SYN packet" ], "sightings": 19259, "tags": [ "udp", "tftp", "icmp", "xdmcp", "tcp", "http" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "114.35.150.12", "classifications": [], "first_seen": { "$date": "2023-01-26T01:32:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:32:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 424, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.35.27.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T01:33:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:33:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1150, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.163.185.94", "classifications": [], "first_seen": { "$date": "2023-01-26T01:40:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:40:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 88" ], "sightings": 424, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.23.57.140", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T01:47:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:54:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 53450, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "134.122.8.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:48:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:48:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1078, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.178.190.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:50:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2150, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.92.167", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:50:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:50:31Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1617, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "68.226.169.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T01:51:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:51:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1078, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.115.100", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:52:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:52:08Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1617, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "74.82.47.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:53:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:53:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1078, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T01:55:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:23:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1098, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.251.76.0", "classifications": [], "first_seen": { "$date": "2023-01-26T01:57:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:57:20Z" }, "ports": [ 23710 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 1078, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.133.206.108", "classifications": [], "first_seen": { "$date": "2023-01-26T01:52:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:52:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 423, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "122.116.219.158", "classifications": [], "first_seen": { "$date": "2023-01-26T01:56:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T01:56:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1269, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "164.92.142.67", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:00:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:11:22Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29017, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.23", "classifications": [ "Misc activity", "Information Leak", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T02:09:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:44:23Z" }, "ports": [ 0, 22, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt" ], "sightings": 6280, "tags": [ "icmp", "tcp", "ssh", "udp" ], "rule_count": 7, "classification_count": 4 }, { "ioc": "104.250.52.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:12:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:05:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.114.190", "classifications": [], "first_seen": { "$date": "2023-01-26T02:06:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:06:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 48", "ET 3CORESec Poor Reputation IP group 39" ], "sightings": 1266, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "193.163.125.37", "classifications": [], "first_seen": { "$date": "2023-01-26T02:12:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:12:42Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 422, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.219.251.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:16:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:22:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2488, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:19:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T04:54:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3306, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:20:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:41:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14333, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.14", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:22:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:00:08Z" }, "ports": [ 53, 0, 5632, 22 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 22558, "tags": [ "udp", "icmp", "alert", "tcp", "ssh" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "152.32.198.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:28:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:28:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1072, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.200.63.217", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:28:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:02:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 85746, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.57.92.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T02:29:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:09:54Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3415, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.136.50.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:34:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:48:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48587, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.250.20.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T02:39:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:01:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6288, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.91.65.63", "classifications": [], "first_seen": { "$date": "2023-01-26T02:45:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:45:53Z" }, "ports": [ 46880 ], "reporting_nodes": 1, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management" ], "sightings": 2940, "tags": [ "alert", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "74.82.47.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:47:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:42:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31777, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.88.240.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T02:55:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:56:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1068, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.236.59.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:55:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:55:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2670, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "64.62.197.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T02:57:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T07:08:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13096, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.227.42", "classifications": [], "first_seen": { "$date": "2023-01-26T02:53:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:53:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 41", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1257, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "128.199.192.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T02:57:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T02:57:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 26", "ET 3CORESec Poor Reputation IP group 11", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3105, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.126.218.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T03:01:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:02:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1066, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.136.40.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T03:02:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:30:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.196.240.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T03:03:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:03:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1066, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.33.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T03:04:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:05:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1066, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.149.128.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T03:09:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T04:05:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.253.170.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T03:15:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:20:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1713, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.93.111.210", "classifications": [], "first_seen": { "$date": "2023-01-26T03:06:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:06:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 418, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.94.138.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T03:17:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:24:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1717, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.57.180.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T03:20:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1275, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.78.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T03:23:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:07:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2024, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.38.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T03:25:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:16:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6416, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.161.17.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T03:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:52:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2098, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.34.67.27", "classifications": [], "first_seen": { "$date": "2023-01-26T03:27:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:27:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 417, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "14.34.17.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T03:44:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:24:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1588, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "70.161.115.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T03:46:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T04:07:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.91.119.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T03:46:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:51:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.187.93.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T03:52:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:53:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1060, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "44.197.234.135", "classifications": [], "first_seen": { "$date": "2023-01-26T03:58:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:58:35Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 530, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.176.147.121", "classifications": [], "first_seen": { "$date": "2023-01-26T03:52:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:52:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 415, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "180.233.231.137", "classifications": [], "first_seen": { "$date": "2023-01-26T03:55:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:56:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1245, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "87.92.120.93", "classifications": [], "first_seen": { "$date": "2023-01-26T03:58:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T03:58:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 830, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "65.49.20.108", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T04:02:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:13:14Z" }, "ports": [ 0, 177, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "(stream_tcp) reset outside window" ], "sightings": 9375, "tags": [ "icmp", "udp", "xdmcp", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.133.190.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T04:04:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T04:04:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1058, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.151.75.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T04:04:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:26:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1537, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.184.223.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T04:07:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T04:08:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1058, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.240.23.236", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T04:10:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:37:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 57820, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "27.96.240.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T04:10:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:26:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1631, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.102", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T04:11:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:30:42Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 46269, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "221.156.74.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T04:14:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:55:15Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20727, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.71.134.165", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T04:19:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:44:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 64669, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "45.93.16.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:24:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T04:24:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1056, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.157.10.217", "classifications": [], "first_seen": { "$date": "2023-01-26T04:25:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:59:13Z" }, "ports": [ 15454, 54945, 59630, 64512, 38650 ], "reporting_nodes": 2, "rules": [ "(tcp) XMAS attack detected", "(tcp) TCP SYN with RST", "(tcp) TCP SYN with FIN" ], "sightings": 28777, "tags": [ "tcp" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "213.156.18.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:28:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:40:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11707, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:30:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:56:36Z" }, "ports": [ 80, 0 ], "reporting_nodes": 3, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 33009, "tags": [ "tcp", "http", "icmp", "alert" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "184.105.247.212", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:31:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:53:31Z" }, "ports": [ 80, 161, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2197, "tags": [ "tcp", "http", "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "64.62.197.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:41:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:29:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19150, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.74.229", "classifications": [], "first_seen": { "$date": "2023-01-26T04:35:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T04:35:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 412, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "101.71.134.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:48:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:14:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 62842, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "65.49.20.94", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-26T04:50:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:16:40Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 12734, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:51:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:19:03Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 13758, "tags": [ "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "94.74.67.250", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:52:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:45:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 59883, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.94.138.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:57:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:05:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33317, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T04:59:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:08:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2508, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.112.240.133", "classifications": [], "first_seen": { "$date": "2023-01-26T04:46:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:11:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 35845, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "62.89.6.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:03:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:03:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2625, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "211.248.5.29", "classifications": [], "first_seen": { "$date": "2023-01-26T05:14:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:14:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 410, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.199.94.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:16:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:16:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1048, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:16:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T00:44:00Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 8366, "tags": [ "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "192.241.225.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:16:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:16:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1048, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.253.166.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:17:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:17:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1048, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.132.223.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:18:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:18:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1048, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.123.101.228", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T05:18:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:59:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 89979, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "65.49.20.66", "classifications": [ "Misc activity", "Decode of an RPC Query", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-26T05:20:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:47:46Z" }, "ports": [ 0, 111, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-TFTP Get" ], "sightings": 17772, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "tftp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "221.156.75.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T05:21:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:22:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1048, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.158.213.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T05:22:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:22:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1048, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.73.107.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T05:27:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:21:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 15271, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "74.82.47.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:30:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:45:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22036, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.37.244.77", "classifications": [], "first_seen": { "$date": "2023-01-26T05:17:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:17:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 409, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "14.32.51.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T05:33:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:19:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 7" ], "sightings": 1550, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "113.31.110.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:42:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:21:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 48788, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "60.51.162.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T05:42:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:43:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1046, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.220.167.38", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:32:18Z" }, "ports": [ 5000, 0, 6082, 6092, 7082, 5099, 9050, 5060, 5080, 5062 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10879, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "73.84.162.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:42:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1046, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.114.0.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:43:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T16:17:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3034, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.122.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T05:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:44:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1642, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.56.96.31", "classifications": [], "first_seen": { "$date": "2023-01-26T05:48:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:48:05Z" }, "ports": [ 4443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 522, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.228.14.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T05:48:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1044, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.70", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:51:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:52:09Z" }, "ports": [ 111, 0, 80 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 68" ], "sightings": 4361, "tags": [ "udp", "sunrpc", "portmapper", "icmp", "alert", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.220.205.196", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T05:51:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:51:52Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 522, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "74.82.47.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:55:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:15:34Z" }, "ports": [ 123, 0, 1434 ], "reporting_nodes": 2, "rules": [ "(geneve) invalid header", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 11295, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "191.96.36.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T05:58:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:58:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.189.72.128", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T05:59:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:53:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 81572, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "148.251.85.116", "classifications": [], "first_seen": { "$date": "2023-01-26T05:50:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T05:50:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 407, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "152.32.141.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T06:04:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:04:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1042, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.149.181.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:05:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:05:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1042, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.126.211.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:07:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:09:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1042, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.228.5.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:09:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:11:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1042, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.208.205.59", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T06:14:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:14:54Z" }, "ports": [ 68, 162, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 1563, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "220.133.144.131", "classifications": [], "first_seen": { "$date": "2023-01-26T06:06:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:06:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 406, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "1.14.126.238", "classifications": [], "first_seen": { "$date": "2023-01-26T06:09:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:26:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum" ], "sightings": 34894, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.56.96.73", "classifications": [], "first_seen": { "$date": "2023-01-26T06:22:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:48:56Z" }, "ports": [ 8081, 8888, 4433 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1182, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.227.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T06:23:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:48:36Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3108, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "119.200.132.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:24:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:25:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1040, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.152.16.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:25:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:26:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1040, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.164.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:26:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:27:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1040, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.11.34", "classifications": [], "first_seen": { "$date": "2023-01-26T06:18:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:14:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2955, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.110.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T06:26:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:55:30Z" }, "ports": [ 22, 0 ], "reporting_nodes": 3, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27023, "tags": [ "alert", "tcp", "ssh", "anomaly", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "114.33.252.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:36:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:37:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1038, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.34.195.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:43:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:16:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3592, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.131", "classifications": [], "first_seen": { "$date": "2023-01-26T06:45:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:21:07Z" }, "ports": [ 20368, 2836, 14672, 19298 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 6995, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "115.227.49.24", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T06:46:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:25:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 86355, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.25", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T06:48:53Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:22:30Z" }, "ports": [ 0, 1900, 22, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 42235, "tags": [ "icmp", "udp", "ssh", "tcp", "ZGrab" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "65.49.20.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T06:50:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:06:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6886, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.123.171.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:56:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:57:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1034, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.254.19.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T06:57:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:58:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1034, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.197.78", "classifications": [], "first_seen": { "$date": "2023-01-26T06:52:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T06:52:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 806, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.121.46.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T07:03:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:03:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2064, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.61.207.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T07:05:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:54:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2268, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.94.188.130", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-26T07:11:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:07:11Z" }, "ports": [ 53, 0, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 20768, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "64.62.197.142", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-26T07:15:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:26:40Z" }, "ports": [ 0, 80, 69 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "PROTOCOL-TFTP Get" ], "sightings": 17758, "tags": [ "icmp", "alert", "tcp", "http", "udp", "tftp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "170.39.224.220", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T07:16:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:01:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 72615, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "183.100.212.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T07:16:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:17:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1028, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.112.104.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T07:17:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:17:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1028, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.133.43.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T07:20:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:21:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1028, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.49.144.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T07:22:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:23:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4778, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.10.202.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T07:25:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:26:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1028, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.2", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T07:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:02:42Z" }, "ports": [ 1900, 0, 53, 161, 22, 1434 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt" ], "sightings": 39902, "tags": [ "udp", "icmp", "snmp", "tcp", "ssh" ], "rule_count": 11, "classification_count": 5 }, { "ioc": "92.241.101.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T07:27:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:28:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1028, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.246.34.51", "classifications": [], "first_seen": { "$date": "2023-01-26T07:16:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:16:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 401, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "2a04:4e42:0079:0000:0000:0000:0000:0561", "classifications": [], "first_seen": { "$date": "2023-01-26T07:22:02Z" }, "ja3": [ "8662467bc96db2d387755570446a7946" ], "last_seen": { "$date": "2023-06-30T13:00:38Z" }, "ports": [ 58424, 58504, 58506, 59018, 59082, 59186, 59188, 33190, 47018, 47032, 52410, 48398, 48402 ], "reporting_nodes": 1, "rules": [], "sightings": 1636, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "1.117.140.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T07:31:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:33:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2010, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.151.135.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T07:33:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:33:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1026, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.57.9.146", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T07:35:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:19:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 91404, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T07:35:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:01:45Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 7654, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.24.6.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T07:42:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:43:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1026, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.220.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T07:45:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:36:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1577, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.48", "classifications": [ "Attempted Information Leak", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-26T07:50:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:48:46Z" }, "ports": [ 161, 0, 111 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 3415, "tags": [ "udp", "snmp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "107.170.240.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T07:51:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:51:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1024, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.10", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T07:57:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:34:00Z" }, "ports": [ 5632, 0, 1900, 53 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 9515, "tags": [ "udp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "45.55.0.21", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T07:58:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:09:45Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 2007, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "221.147.181.183", "classifications": [], "first_seen": { "$date": "2023-01-26T07:48:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:48:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 399, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.132.216.78", "classifications": [], "first_seen": { "$date": "2023-01-26T07:52:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T07:52:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 399, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "64.62.197.184", "classifications": [ "Decode of an RPC Query", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T07:53:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:25:58Z" }, "ports": [ 80, 111, 0, 161 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "(stream_tcp) data on SYN packet", "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 51260, "tags": [ "alert", "tcp", "http", "udp", "sunrpc", "portmapper", "icmp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "107.170.241.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:01:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:16:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.88.25.61", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-26T08:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:08:54Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 5080, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.247.200", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T08:08:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:36:36Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 3176, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.147.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:09:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T23:02:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1040, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.78.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T08:09:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:10:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1022, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.37", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T08:10:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:23:17Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 10356, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "65.49.20.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:10:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:01:12Z" }, "ports": [ 0, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 68" ], "sightings": 2059, "tags": [ "icmp", "alert", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "143.198.128.123", "classifications": [], "first_seen": { "$date": "2023-01-26T08:03:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:28:31Z" }, "ports": [ 80, 22, 0 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 44", "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 1672, "tags": [ "alert", "tcp", "http", "ssh", "icmp" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "67.167.226.245", "classifications": [], "first_seen": { "$date": "2023-01-26T08:05:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:05:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 398, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.133.96.31", "classifications": [], "first_seen": { "$date": "2023-01-26T08:09:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:09:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 796, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.134.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:17:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:12:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1660, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.236.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T08:19:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1020, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.51", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T08:20:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:35:50Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 24074, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.54", "classifications": [ "Attempted Information Leak", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-26T08:22:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:32:03Z" }, "ports": [ 161, 0, 111, 22 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 19292, "tags": [ "udp", "snmp", "icmp", "sunrpc", "portmapper", "alert", "tcp", "ssh", "Go" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "65.49.20.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:23:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:20:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4954, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.200.109.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:24:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:24:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1020, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.60.144.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:24:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:24:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2040, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.132.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T08:24:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:12:51Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan" ], "sightings": 2106, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "192.241.196.63", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T08:29:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:49:21Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 2625, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.146.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:46:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.240.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:38:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:36:07Z" }, "ports": [ 161, 0, 162 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 9090, "tags": [ "tcp", "snmp", "icmp", "snmptrap" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "65.49.20.76", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T08:40:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:41:57Z" }, "ports": [ 0, 1900, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 14115, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "206.1.136.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T08:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:42:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1016, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.220.55.2", "classifications": [], "first_seen": { "$date": "2023-01-26T08:37:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:37:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 396, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.126.116.127", "classifications": [], "first_seen": { "$date": "2023-01-26T08:44:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:44:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 49" ], "sightings": 792, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "108.184.94.110", "classifications": [], "first_seen": { "$date": "2023-01-26T08:44:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:44:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 396, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.229.44.21", "classifications": [], "first_seen": { "$date": "2023-01-26T08:44:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:44:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 396, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.75.29.230", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T08:49:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:42:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 85386, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "175.139.171.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T08:59:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:00:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1014, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.116.135.59", "classifications": [], "first_seen": { "$date": "2023-01-26T08:52:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T08:59:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 7505, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "138.94.84.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T09:01:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:02:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1012, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.20.251.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T09:10:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:11:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1012, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.158.113.168", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T09:11:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:06:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 100178, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "106.249.240.114", "classifications": [], "first_seen": { "$date": "2023-01-26T09:07:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:11:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 26377, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "107.150.102.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T09:25:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:25:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1010, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "168.196.105.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T09:25:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:27:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1010, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.142.244.217", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T09:35:33Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:14:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 53504, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "167.248.133.137", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T09:39:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:00:41Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 44993, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.211.40.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T09:41:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:41:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1008, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.8", "classifications": [], "first_seen": { "$date": "2023-01-26T09:37:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:00:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 964, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.222.69.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T09:48:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T09:49:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1006, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.189.29.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T09:59:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:05:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3462, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.122.235.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:00:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:39:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 46" ], "sightings": 1713, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "37.26.34.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:05:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:05:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1004, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.179.27.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:06:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1004, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.186.218.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:11:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1004, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.70.0.94", "classifications": [], "first_seen": { "$date": "2023-01-26T10:12:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:23:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1199, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.94.138.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T10:18:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:18:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1002, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.165.228.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:30:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:30:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1002, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.128.128", "classifications": [], "first_seen": { "$date": "2023-01-26T10:22:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:26:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 27160, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "220.132.130.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:37:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:38:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1000, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.89.5.92", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T10:44:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:38:30Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 157126, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "31.0.235.239", "classifications": [], "first_seen": { "$date": "2023-01-26T10:34:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:34:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 387, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "118.165.221.85", "classifications": [], "first_seen": { "$date": "2023-01-26T10:37:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:37:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 387, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "1.170.117.77", "classifications": [], "first_seen": { "$date": "2023-01-26T10:38:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:38:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 387, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "74.82.47.23", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-26T10:46:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:46:58Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1497, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.228.104.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:53:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:54:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 998, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.92.23.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:57:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 998, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.145.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T10:57:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T10:57:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 998, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "155.94.254.7", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T11:00:25Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:49:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 79953, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "122.116.21.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:00:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:00:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 996, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.211.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:02:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:03:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 996, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.205.245.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:12:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:13:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 996, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.241.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:14:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:15:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 996, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.144.161.145", "classifications": [], "first_seen": { "$date": "2023-01-26T11:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:05:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 29260, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "218.210.34.133", "classifications": [], "first_seen": { "$date": "2023-01-26T11:07:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:07:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 385, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "183.106.87.159", "classifications": [], "first_seen": { "$date": "2023-01-26T11:08:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:08:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 770, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "124.48.195.174", "classifications": [], "first_seen": { "$date": "2023-01-26T11:11:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:11:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 385, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.228.145.118", "classifications": [], "first_seen": { "$date": "2023-01-26T11:12:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:12:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 770, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "222.118.128.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:21:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:21:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 994, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.159.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:27:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:29:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 994, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T11:25:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T07:54:33Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 386, "tags": [ "alert", "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "167.248.133.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T11:31:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:59:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4524, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.49.135.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:32:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:32:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 992, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.62.220.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:33:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:33:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 992, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.80.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:34:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:34:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 992, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.230.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T11:37:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:37:29Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1488, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.240.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T11:40:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:40:48Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1488, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "37.44.238.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T11:43:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:00:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6770, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.29.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:51:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:52:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 990, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "130.25.59.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T11:52:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T11:54:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 990, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.239.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T12:01:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:15:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1868, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.154.190.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T12:05:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:06:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 988, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.64.10.35", "classifications": [], "first_seen": { "$date": "2023-01-26T12:08:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:06:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "(stream_tcp) reset outside window", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 21873, "tags": [ "tcp", "ssh", "alert", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "181.4.30.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T12:11:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:12:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 988, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.8.68.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T12:12:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:12:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 988, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.193.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T12:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:06:23Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 9026, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "109.123.245.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T12:33:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:33:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 984, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.112.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T12:34:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:34:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 984, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.241.250.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T12:35:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:35:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 984, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.172.199.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T12:43:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:57:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 986, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.225.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T12:45:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:45:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 984, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.195.53.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T12:33:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:47:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6212, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.107.248.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T12:38:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:45:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2080, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "114.32.46.110", "classifications": [], "first_seen": { "$date": "2023-01-26T12:40:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T12:40:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 379, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "170.106.115.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T12:51:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:26:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3008, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.123.105.85", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T12:57:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:12:12Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 45539, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.37.61.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T13:05:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:07:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 980, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.116.23.150", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T13:09:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:22:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 75131, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "135.125.108.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T13:13:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:13:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 980, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.217.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T13:13:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:48Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16020, "tags": [ "icmp", "ssh", "tcp", "Go" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.83.138.123", "classifications": [], "first_seen": { "$date": "2023-01-26T13:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:52:11Z" }, "ports": [ 22, 88 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "(port_scan) TCP portscan" ], "sightings": 87192, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "167.248.133.120", "classifications": [], "first_seen": { "$date": "2023-01-26T13:04:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:03:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1888, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.117.95.108", "classifications": [], "first_seen": { "$date": "2023-01-26T13:12:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:12:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 754, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.120.90.33", "classifications": [], "first_seen": { "$date": "2023-01-26T13:14:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:14:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 48", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1131, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "121.155.127.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T13:21:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:37:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 8" ], "sightings": 1478, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.5.187.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T13:22:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:48:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Time-To-Live Exceeded in Transit" ], "sightings": 1851, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.176.167.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T13:24:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:26:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 976, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.41.251.141", "classifications": [], "first_seen": { "$date": "2023-01-26T13:26:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:22:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 1796, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.140.234.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T13:27:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:27:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 975, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.142.106.139", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T13:27:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:28:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 61664, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "51.75.166.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T13:28:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:28:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 974, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.196.66.250", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T13:29:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:29:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7305, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.25.40.41", "classifications": [], "first_seen": { "$date": "2023-01-26T13:18:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:18:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 376, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "87.236.176.99", "classifications": [], "first_seen": { "$date": "2023-01-26T13:26:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:27:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1128, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "92.118.207.240", "classifications": [], "first_seen": { "$date": "2023-01-26T13:35:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:35:00Z" }, "ports": [ 43800 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 486, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.188.35.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T13:35:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:26:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1459, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.13.166.87", "classifications": [], "first_seen": { "$date": "2023-01-26T13:44:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:44:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 56", "ET 3CORESec Poor Reputation IP group 39" ], "sightings": 1125, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "114.34.150.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T13:48:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:08:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1183, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.20.144.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T13:53:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:54:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 970, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.85.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T13:57:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:58:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 970, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.38.112.62", "classifications": [], "first_seen": { "$date": "2023-01-26T13:49:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 88" ], "sightings": 748, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.7.143.135", "classifications": [], "first_seen": { "$date": "2023-01-26T13:50:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T13:50:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 59" ], "sightings": 1122, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.170.84.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T14:03:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:03:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 968, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.194.80.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T14:03:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:55:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14181, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.35.130.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T14:06:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:21:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11507, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.139.7.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T14:06:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:08:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 968, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.34.10.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T14:07:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:07:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 968, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.5", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T14:13:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:31:29Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2573, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "49.172.195.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T14:17:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:17:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 966, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.234.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T14:28:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:17:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.145.60", "classifications": [], "first_seen": { "$date": "2023-01-26T14:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:26:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 17", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2679, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "181.219.149.148", "classifications": [], "first_seen": { "$date": "2023-01-26T14:24:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:24:26Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 21" ], "sightings": 372, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.234.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T14:31:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:25:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "169.228.66.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T14:32:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:32:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 81052, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.220.204.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T14:41:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:43:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 964, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.194.13.17", "classifications": [], "first_seen": { "$date": "2023-01-26T14:37:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:37:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 742, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.90.162.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T14:57:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:36:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1918, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.235.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T14:59:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:25:44Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 5" ], "sightings": 1970, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.226.217.217", "classifications": [], "first_seen": { "$date": "2023-01-26T14:47:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:47:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 740, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.72.80.162", "classifications": [], "first_seen": { "$date": "2023-01-26T14:54:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T14:54:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 370, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.126.239.158", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44729, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.228.190.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:08:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:08:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 960, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.229.44.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:08:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:08:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 960, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.250.90.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:10:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:58:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 61" ], "sightings": 1557, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.162.241.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:10:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:10:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 960, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.95.72", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T15:10:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:58:42Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 5674, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.209.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:13:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:40:21Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 972, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.109.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:13:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:13:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 960, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.111.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:13:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:43:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10310, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.152.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:36:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1505, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.52.158.153", "classifications": [], "first_seen": { "$date": "2023-01-26T15:01:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:02:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2214, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.108.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:20:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 958, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.143.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:17:07Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 970, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.130.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:13:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2736, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.202.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:22:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:06:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12550, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.116.116.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:26:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:26:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 958, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.111.7.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:29:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:31:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 957, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.218.100", "classifications": [], "first_seen": { "$date": "2023-01-26T15:23:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:23:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 41", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1104, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.243.138.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:25:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1814, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.227.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:34:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T07:28:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1524, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.143.131.36", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T15:37:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:30:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 66115, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "144.217.17.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:39:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:39:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 956, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.231.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:42:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:26:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7111, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.226.113.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:45:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:10:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.211.169.30", "classifications": [], "first_seen": { "$date": "2023-01-26T15:35:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:35:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 734, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "222.118.89.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:36:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:38:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1248, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.77.74.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:47:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:49:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 954, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:50:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:50:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 954, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.205.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T15:50:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:08:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15965, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.177.172.143", "classifications": [], "first_seen": { "$date": "2023-01-26T15:51:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:51:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 954, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.116.98.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:58:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:00:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5724, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.146.60", "classifications": [], "first_seen": { "$date": "2023-01-26T15:50:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:50:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 18", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1098, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "58.95.123.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T15:51:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:52:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1551, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.192.211.100", "classifications": [], "first_seen": { "$date": "2023-01-26T15:57:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T15:57:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 366, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "179.57.112.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:05:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:47:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1430, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.72.179.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:12:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:41:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 116" ], "sightings": 8229, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.78.47.189", "classifications": [], "first_seen": { "$date": "2023-01-26T16:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:13:23Z" }, "ports": [ 27364, 27368, 11503, 11501, 8264, 8152, 30030, 20020 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2552, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.231.234.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T16:15:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:38:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.119.64.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:15:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:21:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 132", "ET 3CORESec Poor Reputation IP group 32" ], "sightings": 4473, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "121.186.100.42", "classifications": [], "first_seen": { "$date": "2023-01-26T16:02:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:02:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 365, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.152.52.108", "classifications": [], "first_seen": { "$date": "2023-01-26T16:12:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:12:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 365, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "110.45.147.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:15:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:43:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14957, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.43.54.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:16:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:30:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2375, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.234.9", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-26T16:19:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:09:44Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 12270, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "173.161.156.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:20:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:31:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3799, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.60.208.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:26:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:07:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 985, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "143.110.190.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:28:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:18:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 43" ], "sightings": 51513, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.172.56.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:28:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:28:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 475, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.34.138.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:28:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:29:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 950, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.155.0.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:29:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:46:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3785, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.209.74", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-26T16:29:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:44:18Z" }, "ports": [ 0, 161, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 26217, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "212.12.31.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:30:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:56:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 59461, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.152.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T16:31:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:31:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 948, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.187.92.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:32:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:01:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90749, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.241.227.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:32:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:46:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4257, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.128.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T16:34:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:56:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8966, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.49.119.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:28:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6776, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.153", "classifications": [], "first_seen": { "$date": "2023-01-26T16:40:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:40:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 363, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.74.5.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:43:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:38:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 94", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 103994, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.234.110", "classifications": [], "first_seen": { "$date": "2023-01-26T16:43:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:42:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 52", "ET 3CORESec Poor Reputation IP group 14" ], "sightings": 14440, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "165.227.83.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T16:46:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:46:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 72", "ET 3CORESec Poor Reputation IP group 17", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4008, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "159.65.180.64", "classifications": [], "first_seen": { "$date": "2023-01-26T16:46:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:46:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61" ], "sightings": 362, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.94.138.44", "classifications": [], "first_seen": { "$date": "2023-01-26T16:49:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T16:49:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 724, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.133.89.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:04:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:04:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 942, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.3.210.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T17:11:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:37:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11005, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.96.200", "classifications": [], "first_seen": { "$date": "2023-01-26T17:06:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:51:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34", "ET SCAN Potential SSH Scan" ], "sightings": 42165, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.68.125.201", "classifications": [], "first_seen": { "$date": "2023-01-26T17:07:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:40:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 165", "ET SCAN Potential SSH Scan" ], "sightings": 14669, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.237.146.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T17:20:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:05:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28214, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T17:21:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:16:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.108.107.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T17:23:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:23:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1877, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.5", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T17:25:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:48:24Z" }, "ports": [ 0, 22, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 4950, "tags": [ "icmp", "alert", "tcp", "ssh", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "198.235.24.169", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T17:25:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:12:15Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6047, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.137.197.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:26:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:27:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 938, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.237.43.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:27:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:27:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 938, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.179.4", "classifications": [], "first_seen": { "$date": "2023-01-26T17:31:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:28:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 45" ], "sightings": 14641, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.150.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:31:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:31:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 936, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.126.217.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:31:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:42:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 47" ], "sightings": 14277, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.73.131.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:32:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:13:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13982, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.84.117.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:34:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:47:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 4673, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.68.38.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:34:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:25:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13966, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.62.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:49:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4669, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.72.142.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:35:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:54:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4666, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.55.56.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:35:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:37:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 113" ], "sightings": 3740, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.74.236.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:35:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:48:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3268, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.156.128.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:35:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:16:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 940, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.74.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:37:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:16:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 76", "ET 3CORESec Poor Reputation IP group 17", "ET SCAN Potential SSH Scan" ], "sightings": 25166, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "207.154.246.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:38:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:17:51Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET SCAN Potential SSH Scan" ], "sightings": 52670, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert", "anomaly" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "198.199.103.221", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T17:40:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:31:04Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 31994, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "216.196.223.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:42:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:42:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 934, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.136.155.36", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T17:43:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:33:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 176971, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "102.216.213.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T17:44:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:10:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62582, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.188.141.105", "classifications": [], "first_seen": { "$date": "2023-01-26T17:33:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:26:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 96" ], "sightings": 21394, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "85.99.108.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:34:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:09:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 184", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 414, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.33.243.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:34:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:33:07Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48284, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.134.90.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:34:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:34:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 131", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2499, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.163.6", "classifications": [], "first_seen": { "$date": "2023-01-26T17:35:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:35:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12" ], "sightings": 359, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.132.196.160", "classifications": [], "first_seen": { "$date": "2023-01-26T17:35:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:31:57Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 30", "ET 3CORESec Poor Reputation IP group 35" ], "sightings": 722, "tags": [ "alert", "tcp", "http" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "27.128.166.246", "classifications": [], "first_seen": { "$date": "2023-01-26T17:35:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T17:40:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 25090, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "43.157.31.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:39:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:28:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 154", "ET 3CORESec Poor Reputation IP group 35", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20641, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "159.65.136.44", "classifications": [], "first_seen": { "$date": "2023-01-26T17:41:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:48:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61" ], "sightings": 13529, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.238.18", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T17:46:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:04:43Z" }, "ports": [ 0, 162 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 1994, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.224.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T17:51:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:08:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2078, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.103.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T17:53:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:19:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3446, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.217.127.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T17:59:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:00:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 932, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.186.249.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T18:01:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:01:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 930, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.14.106.240", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T18:01:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:50:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 82412, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "212.129.30.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:02:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:19:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4647, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.165.24.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:03:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:19:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2788, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.21.113.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:05:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:56:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13881, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.146.175.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T18:07:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:29:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15330, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.212.133.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T18:09:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:56:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7604, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.143.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:09:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:10:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 930, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.190.125.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:11:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:58:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13865, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.243.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:12:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:24:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4178, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.108.66.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:15:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:15:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 930, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.11.4", "classifications": [], "first_seen": { "$date": "2023-01-26T18:14:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:18:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 18", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4490, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "194.195.246.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T18:18:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:44:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1850, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.17.94.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:23:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:23:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 464, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.250.74.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:27:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:00:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 61595, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.232.166.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:27:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:43:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3700, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.185.197.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:28:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:42:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2776, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.164.12.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:28:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:28:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1481, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.171.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:28:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:25:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4933, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.120.149.150", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T18:29:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:43:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 57750, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "144.217.87.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:29:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:46:34Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 47" ], "sightings": 16349, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.141.139.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:29:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:48:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2772, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.188.251.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:29:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:46:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4160, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.154.225.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:30:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:31:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 49166, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.221.239.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:30:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:44:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3699, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.205.33.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:31:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:42:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2313, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "78.135.85.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T18:31:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:31:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5556, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.204.226.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:31:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:30:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13771, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "163.177.9.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:35:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:05:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 4001, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.114.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T18:40:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:45:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20098, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.187.251.210", "classifications": [], "first_seen": { "$date": "2023-01-26T18:44:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:44:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 354, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.237.145.157", "classifications": [], "first_seen": { "$date": "2023-01-26T18:46:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T18:59:39Z" }, "ports": [ 58603, 4443, 8888, 10443, 4433, 3306, 5001, 6443, 9443, 3389, 50001, 8443, 8083, 8081, 7443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 30506, "tags": [ "tcp", "mysql", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "216.11.148.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T18:49:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:49:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 918, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.182.119.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:50:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:51:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 918, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.164.48.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T18:50:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:52:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 918, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.42.176.206", "classifications": [], "first_seen": { "$date": "2023-01-26T18:47:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T18:47:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 706, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "115.160.100.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T19:01:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:01:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1832, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.105.217.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:02:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:18:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3663, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.228.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T19:05:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:50:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21341, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.131.71.129", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T19:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:08:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 19490, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "37.44.238.188", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-26T19:05:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:05:22Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 5850, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "117.144.213.77", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T19:11:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:51:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 58703, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "143.110.220.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:13:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:53:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 44", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20426, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.227.253.185", "classifications": [], "first_seen": { "$date": "2023-01-26T19:14:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:14:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 352, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.123.199.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:15:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:20:19Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1429, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.93.200.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:27:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:16:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16783, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.170.183.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:27:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:28:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 914, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.107.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:28:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:44:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4105, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.104.27.190", "classifications": [], "first_seen": { "$date": "2023-01-26T19:28:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:16:37Z" }, "ports": [ 6443, 50001 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 695, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "158.69.80.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:29:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:37:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 58" ], "sightings": 168246, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.67.202.249", "classifications": [], "first_seen": { "$date": "2023-01-26T19:18:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:23:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 26325, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "192.241.148.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:24:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:47:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2982, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.75.179.70", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T19:30:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:06:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 131269, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "46.175.129.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T19:32:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:32:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 912, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.125.120.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:36:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 912, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.34.58.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:36:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:36:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 912, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.211", "classifications": [], "first_seen": { "$date": "2023-01-26T19:40:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:05:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1522, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "203.190.55.194", "classifications": [], "first_seen": { "$date": "2023-01-26T19:43:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:40:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120" ], "sightings": 1426, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.199.231.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:46:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:47:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1820, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.195.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:49:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:49:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 910, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.94.95.25", "classifications": [], "first_seen": { "$date": "2023-01-26T19:47:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:47:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 79" ], "sightings": 349, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.119.253.45", "classifications": [], "first_seen": { "$date": "2023-01-26T19:48:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:48:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1047, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.154.240.240", "classifications": [], "first_seen": { "$date": "2023-01-26T19:48:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:56:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69" ], "sightings": 13203, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "37.32.25.231", "classifications": [], "first_seen": { "$date": "2023-01-26T19:48:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T19:52:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1396, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.71.136.141", "classifications": [], "first_seen": { "$date": "2023-01-26T19:48:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:42:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 75", "ET SCAN Potential SSH Scan" ], "sightings": 15652, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "92.50.249.166", "classifications": [], "first_seen": { "$date": "2023-01-26T19:49:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:04:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3488, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "111.12.63.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T19:49:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:44:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 102336, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.10.187.178", "classifications": [], "first_seen": { "$date": "2023-01-26T20:02:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:02:16Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 454, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.237.45.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T20:02:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:03:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 908, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.110.158.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T20:11:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:15:35Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1223, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.108.118.30", "classifications": [], "first_seen": { "$date": "2023-01-26T20:06:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:31:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3292, "tags": [ "ssh", "tcp", "ssh", "paramiko_2.12.0", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "117.50.66.128", "classifications": [], "first_seen": { "$date": "2023-01-26T20:07:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:21:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1391, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.127.188.139", "classifications": [], "first_seen": { "$date": "2023-01-26T20:11:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:26:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 54", "ET 3CORESec Poor Reputation IP group 39", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 2262, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "24.103.60.242", "classifications": [], "first_seen": { "$date": "2023-01-26T20:11:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:11:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 348, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "62.231.21.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T20:23:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:03:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 171" ], "sightings": 3657, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.148.246.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T20:26:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:14:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13536, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.114.38.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T20:29:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:04:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.105.116.158", "classifications": [], "first_seen": { "$date": "2023-01-26T20:28:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:28:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1041, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.35.30.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T20:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:40:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1737, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "70.123.147.18", "classifications": [], "first_seen": { "$date": "2023-01-26T20:32:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:32:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 346, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "44.192.247.87", "classifications": [], "first_seen": { "$date": "2023-01-26T20:37:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:37:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 692, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.157.190", "classifications": [], "first_seen": { "$date": "2023-01-26T20:42:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:42:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25" ], "sightings": 346, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.70.31.101", "classifications": [], "first_seen": { "$date": "2023-01-26T20:44:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:04:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 8" ], "sightings": 12682, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.116.153.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T20:46:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:47:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 902, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.169.111.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T20:48:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:48:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 902, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.135", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T20:54:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:55:08Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 62632, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.35.89.185", "classifications": [], "first_seen": { "$date": "2023-01-26T20:53:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T20:53:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 345, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.74.4.17", "classifications": [], "first_seen": { "$date": "2023-01-26T21:00:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:00:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 94", "ET 3CORESec Poor Reputation IP group 22" ], "sightings": 690, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "112.195.100.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T21:04:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:15:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1450, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.163", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T21:07:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:47:21Z" }, "ports": [ 0, 1900, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 3816, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "211.105.210.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:11:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:12:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 900, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.253.9.49", "classifications": [], "first_seen": { "$date": "2023-01-26T21:01:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:25:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127", "ET SCAN Potential SSH Scan" ], "sightings": 38009, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "117.205.66.131", "classifications": [], "first_seen": { "$date": "2023-01-26T21:01:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:01:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 343, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.172.218.148", "classifications": [], "first_seen": { "$date": "2023-01-26T21:03:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:03:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 13" ], "sightings": 343, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "222.237.78.200", "classifications": [], "first_seen": { "$date": "2023-01-26T21:03:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:31:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 132", "ET SCAN Potential SSH Scan" ], "sightings": 13412, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.163.152.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:03:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:49:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4938, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.86.95", "classifications": [], "first_seen": { "$date": "2023-01-26T21:03:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:05:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 38" ], "sightings": 1711, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "147.161.2.3", "classifications": [], "first_seen": { "$date": "2023-01-26T21:04:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:04:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49" ], "sightings": 343, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.71.170.172", "classifications": [], "first_seen": { "$date": "2023-01-26T21:05:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:17:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2743, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "209.141.41.38", "classifications": [], "first_seen": { "$date": "2023-01-26T21:14:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:06:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 9802, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "202.215.133.1", "classifications": [], "first_seen": { "$date": "2023-01-26T21:14:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:28:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 118" ], "sightings": 13829, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.232.247.218", "classifications": [], "first_seen": { "$date": "2023-01-26T21:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:16:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 343, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "193.141.60.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:16:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:32:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4489, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.180.143.146", "classifications": [ "Attempted Information Leak", "Misc activity", "Potentially Bad Traffic", "Detection of a Network Scan", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-26T21:18:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:54:14Z" }, "ports": [ 53, 0, 1434, 161, 69, 1900, 111 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 124746, "tags": [ "udp", "icmp", "snmp", "tftp", "sunrpc", "portmapper" ], "rule_count": 11, "classification_count": 5 }, { "ioc": "175.211.139.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:20:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:47:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10987, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.57.49.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:23:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:23:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 898, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.151", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-26T21:23:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:49:12Z" }, "ports": [ 0, 53, 161, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 59908, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "8.213.25.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:24:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:39:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3587, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "140.238.255.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:25:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:39:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3587, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.189.74.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:27:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:03:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6399, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.177.192.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T21:30:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:30:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.206.163.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:30:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:36:25Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2436, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.44.238.80", "classifications": [], "first_seen": { "$date": "2023-01-26T21:17:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:17:50Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 34" ], "sightings": 342, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "113.200.60.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:31:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:31:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 896, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.126.160.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:42:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:42:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 896, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.105.13.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T21:42:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:42:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.212.48", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T21:44:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:23:47Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24534, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "182.252.133.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:35:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:34:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 89", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30868, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "12.53.178.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:51:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:48:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13311, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "105.184.32.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:51:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T21:51:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1784, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.25.10.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:55:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:27:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2091, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.108.118.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:56:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:49:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4380, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.207.230.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T21:58:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:43:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6474, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.241.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:01:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:36:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153" ], "sightings": 4528, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.76.221.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:01:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:02:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 890, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.15.242.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:08:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:09:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 890, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.45", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-26T22:08:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:02:10Z" }, "ports": [ 1900, 0, 5632 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 33303, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.138.209.220", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T22:11:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:50:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 124911, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "121.177.199.237", "classifications": [], "first_seen": { "$date": "2023-01-26T22:03:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:03:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 339, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "193.163.125.216", "classifications": [], "first_seen": { "$date": "2023-01-26T22:08:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:15:31Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 398, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.86.183.82", "classifications": [], "first_seen": { "$date": "2023-01-26T22:10:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:10:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 339, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "178.62.22.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:11:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:20:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 85", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14517, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "154.222.225.106", "classifications": [], "first_seen": { "$date": "2023-01-26T22:11:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:11:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 53" ], "sightings": 339, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.38.231.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:12:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:19:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 164", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40069, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "128.199.33.46", "classifications": [], "first_seen": { "$date": "2023-01-26T22:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:12:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 27", "ET SCAN Potential SSH Scan" ], "sightings": 42289, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "102.22.146.178", "classifications": [], "first_seen": { "$date": "2023-01-26T22:13:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:32:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 1" ], "sightings": 12061, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.124.231", "classifications": [], "first_seen": { "$date": "2023-01-26T22:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:20:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25" ], "sightings": 12414, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "173.59.115.148", "classifications": [], "first_seen": { "$date": "2023-01-26T22:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:11:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 80", "ET SCAN Potential SSH Scan" ], "sightings": 13100, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "62.84.118.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:15:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:53:43Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET 3CORESec Poor Reputation IP group 42", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 10352, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "200.27.113.133", "classifications": [], "first_seen": { "$date": "2023-01-26T22:16:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:16:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 112" ], "sightings": 339, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "91.220.101.17", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-26T22:16:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:59:41Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3540, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.40.77.54", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T22:26:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:26:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2219, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.247.48.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:26:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:26:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 886, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.89.78.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T22:30:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:30:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 886, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.199.224.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:16:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:52:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 170", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 69414, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "211.101.232.229", "classifications": [], "first_seen": { "$date": "2023-01-26T22:29:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:34:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 12461, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "107.170.253.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T22:39:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:39:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9974, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.126.172.66", "classifications": [], "first_seen": { "$date": "2023-01-26T22:37:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:04:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1139, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.221.253.91", "classifications": [], "first_seen": { "$date": "2023-01-26T22:39:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:40:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 18480, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "59.126.229.170", "classifications": [], "first_seen": { "$date": "2023-01-26T22:39:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:39:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 51", "ET 3CORESec Poor Reputation IP group 39", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1344, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "185.226.116.75", "classifications": [], "first_seen": { "$date": "2023-01-26T22:42:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:04:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8712, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.220.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:44:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:56:33Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 160517, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.108.249.2", "classifications": [], "first_seen": { "$date": "2023-01-26T22:46:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:00:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3351, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "144.217.243.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:46:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:05:35Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 47", "ET 3CORESec Poor Reputation IP group 14", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 31795, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "104.255.172.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:47:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:49:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4993, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.248.95.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T22:49:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:25:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 162" ], "sightings": 22230, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.195.49", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T22:55:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:15:28Z" }, "ports": [ 0, 162, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp", "(ssh) payload size incorrect for the given payload" ], "sightings": 1421, "tags": [ "icmp", "tcp", "snmptrap", "ssh" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.35.103.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T22:58:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:58:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 882, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.217.125.87", "classifications": [], "first_seen": { "$date": "2023-01-26T22:53:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T22:53:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 335, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "138.68.69.4", "classifications": [], "first_seen": { "$date": "2023-01-26T23:01:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:01:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 880, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "113.118.195.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:04:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:04:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 880, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.173", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:05:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:05:30Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1320, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "202.124.198.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:05:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:06:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 880, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.174.95.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:08:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:54:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38838, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:08:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:17:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7205, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:08:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:08:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 880, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.86.5.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:16:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 879, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.52.195.108", "classifications": [], "first_seen": { "$date": "2023-01-26T23:02:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:02:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 22698, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.5", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.199.100.218", "classifications": [], "first_seen": { "$date": "2023-01-26T23:12:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:12:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 333, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "81.105.88.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:20:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:21:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 878, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.212.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:22:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:05:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9292, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:23:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:11:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4250, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.62.228.170", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:24:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:19:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 19491, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.135.61.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:24:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:26:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 878, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.226.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:29:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:35:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6392, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.210.102.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:30:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:31:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 877, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:31:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:18:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2676, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.151.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:35:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:35:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 876, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.231.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:40:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:06:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 880, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:42:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:09:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7281, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.225.127.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:45:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:46:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 875, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.18.89.174", "classifications": [], "first_seen": { "$date": "2023-01-26T23:33:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:14:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 7592, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "207.154.244.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:34:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:07:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 124", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 361, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.6.86.134", "classifications": [], "first_seen": { "$date": "2023-01-26T23:35:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:35:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 19" ], "sightings": 331, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "190.117.113.32", "classifications": [], "first_seen": { "$date": "2023-01-26T23:35:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:35:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 101" ], "sightings": 331, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.217.78.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:36:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:42:22Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 6", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37024, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.27.27.133", "classifications": [], "first_seen": { "$date": "2023-01-26T23:36:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:49:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2315, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.71.230.252", "classifications": [], "first_seen": { "$date": "2023-01-26T23:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:36:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9865, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "191.242.105.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T14:57:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 104", "ET 3CORESec Poor Reputation IP group 24", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4619, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "101.231.146.36", "classifications": [], "first_seen": { "$date": "2023-01-26T23:37:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:26:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 2100, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "161.35.24.244", "classifications": [], "first_seen": { "$date": "2023-01-26T23:37:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:37:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 64" ], "sightings": 331, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.30.163.75", "classifications": [], "first_seen": { "$date": "2023-01-26T23:42:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:49:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 992, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.135.20.5", "classifications": [], "first_seen": { "$date": "2023-01-26T23:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:42:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 107", "ET 3CORESec Poor Reputation IP group 25" ], "sightings": 13817, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "34.140.65.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:43:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:32:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 137", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15135, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "49.228.100.82", "classifications": [], "first_seen": { "$date": "2023-01-26T23:44:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:18:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 665, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.28.235.92", "classifications": [], "first_seen": { "$date": "2023-01-26T23:44:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:01:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3631, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "134.209.147.154", "classifications": [], "first_seen": { "$date": "2023-01-26T23:45:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:45:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 31" ], "sightings": 331, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.110.139.246", "classifications": [], "first_seen": { "$date": "2023-01-26T23:45:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:45:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 331, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "50.194.214.214", "classifications": [], "first_seen": { "$date": "2023-01-26T23:45:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:45:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 43" ], "sightings": 331, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.186.147.60", "classifications": [], "first_seen": { "$date": "2023-01-26T23:45:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:00:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 92" ], "sightings": 12137, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.168.155.2", "classifications": [], "first_seen": { "$date": "2023-01-26T23:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:38:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 114" ], "sightings": 19715, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.155.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:50:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:52:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 874, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.189.80.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:52:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:08:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3492, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.163.160.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:52:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:25:24Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 24" ], "sightings": 3092, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.92.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:52:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:10:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13805, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.49.156.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:53:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:07:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2618, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.131.144.12", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-26T23:54:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:35:58Z" }, "ports": [ 0, 162, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp", "(ssh) payload size incorrect for the given payload" ], "sightings": 19585, "tags": [ "icmp", "tcp", "snmptrap", "ssh" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.138.58.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:58:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:58:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 874, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.254.47.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:58:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:28:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6045, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.228.182.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:58:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:58:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 874, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.174.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:47:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:47:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 64", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2869, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.83.144.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:47:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:18:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 128", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 354, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.62.2.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:47:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:41:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 85", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 390, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.163.215.36", "classifications": [], "first_seen": { "$date": "2023-01-26T23:50:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:50:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 660, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.127.56.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-26T23:57:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-26T23:57:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 55", "ET 3CORESec Poor Reputation IP group 39", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1838, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "45.55.0.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-26T23:59:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:16:21Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 34", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1210, "tags": [ "alert", "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "49.7.204.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:04:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:16:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.214.113.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:08:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:08:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 872, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:10:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:38:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:15:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:46:02Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 27747, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.11.106.70", "classifications": [], "first_seen": { "$date": "2023-01-27T00:11:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:11:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 47", "ET 3CORESec Poor Reputation IP group 38" ], "sightings": 987, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.250.6.222", "classifications": [], "first_seen": { "$date": "2023-01-27T00:12:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:33:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 4259, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.202.27", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T00:16:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:04:04Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 25410, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.245.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:20:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:32:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4092, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.134.144.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:26:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:23:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5515, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.249.14", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T00:26:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:17:59Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 22386, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:28:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:18:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3464, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.11.140.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T00:32:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:53:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1408, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.46.17.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T00:34:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:26:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3662, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "131.0.32.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:36:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:36:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 868, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:40:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:34:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6452, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.153.2.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T00:41:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:41:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 866, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.92.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:46:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:25:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14742, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.151", "classifications": [ "Executable code was detected", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:47:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:10:29Z" }, "ports": [ 22, 53, 0, 5632 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 26992, "tags": [ "tcp", "ssh", "udp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.80", "classifications": [ "Misc activity", "Detection of a Network Scan", "Potentially Bad Traffic", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-27T00:48:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:53:15Z" }, "ports": [ 1434, 0, 1900, 69, 111 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-TFTP Get", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 39488, "tags": [ "udp", "icmp", "tftp", "sunrpc", "portmapper" ], "rule_count": 6, "classification_count": 4 }, { "ioc": "198.199.106.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:48:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:16:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16656, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:52:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:55:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7548, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "90.193.246.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T00:54:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:54:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.149", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T00:56:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:41:55Z" }, "ports": [ 1434, 0, 53, 5632, 22 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31709, "tags": [ "udp", "icmp", "tcp", "ssh" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "115.236.8.253", "classifications": [], "first_seen": { "$date": "2023-01-27T00:47:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:47:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 975, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "2a05:d018:091c:3200:c887:2f22:290f:0a7c", "classifications": [], "first_seen": { "$date": "2023-01-27T00:54:27Z" }, "ja3": [ "fb4726d465c5f28b84cd6d14cedd13a7" ], "last_seen": { "$date": "2023-03-06T04:26:40Z" }, "ports": [ 48440, 48776, 48916, 60850, 52018, 38804, 49714 ], "reporting_nodes": 1, "rules": [], "sightings": 1329, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.243.148.20", "classifications": [], "first_seen": { "$date": "2023-01-27T00:57:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T00:57:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 325, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.1.147.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:06:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:07:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 862, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:07:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:38:30Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11286, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "219.85.53.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:10:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:11:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 862, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.16.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:13:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:14:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 862, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:14:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:38:01Z" }, "ports": [ 80, 0, 22 ], "reporting_nodes": 3, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 21073, "tags": [ "tcp", "http", "icmp", "alert", "ssh", "Go" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "190.230.171.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:07:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:29:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2360, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.238.174.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:07:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:20:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 658, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.158.29.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:07:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:15:29Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 108", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 45109, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "118.193.32.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:07:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:14:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10151, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.226.51.36", "classifications": [], "first_seen": { "$date": "2023-01-27T01:08:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:15:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 648, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.246.240.28", "classifications": [], "first_seen": { "$date": "2023-01-27T01:08:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:08:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 7" ], "sightings": 324, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.183.240.177", "classifications": [], "first_seen": { "$date": "2023-01-27T01:09:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:09:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 648, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_6.7p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "134.17.17.185", "classifications": [], "first_seen": { "$date": "2023-01-27T01:10:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:10:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 324, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "190.111.211.81", "classifications": [], "first_seen": { "$date": "2023-01-27T01:11:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:13:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 101", "ET SCAN Potential SSH Scan" ], "sightings": 612, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "119.194.31.45", "classifications": [], "first_seen": { "$date": "2023-01-27T01:15:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:15:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 324, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.218.242.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:19:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:53:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1842, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.117.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:22:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:51:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13427, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:24:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:01:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.233.150.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:29:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:29:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 860, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.249.204.180", "classifications": [], "first_seen": { "$date": "2023-01-27T01:24:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:44:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 115", "ET 3CORESec Poor Reputation IP group 26" ], "sightings": 648, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.243.146.32", "classifications": [], "first_seen": { "$date": "2023-01-27T01:29:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:29:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 646, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.100.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:31:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:30:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5032, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.182.225.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:32:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:35:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10901, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.224.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:33:20Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:08:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13299, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.84.108.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:34:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:48:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 3431, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "156.225.131.253", "classifications": [], "first_seen": { "$date": "2023-01-27T01:36:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:29:58Z" }, "ports": [ 18418, 24562 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 849, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "58.76.177.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:40:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:41:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 858, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.116.66.74", "classifications": [], "first_seen": { "$date": "2023-01-27T01:43:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:11:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 323, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "41.216.182.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:46:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:52:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1712, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.58.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:46:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:47:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 856, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.5", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-27T01:52:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:45:21Z" }, "ports": [ 0, 161, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt" ], "sightings": 59339, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "221.145.187.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:53:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:53:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 854, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.16.76", "classifications": [], "first_seen": { "$date": "2023-01-27T01:53:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:43:19Z" }, "ports": [ 4443, 5443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 665, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.27.25.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:55:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T01:55:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 427, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.172.204.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:55:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:11:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3404, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.207.113.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:56:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:10:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3404, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.60.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:58:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:08:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 84" ], "sightings": 5052, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.234.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T01:58:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:21:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9442, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.38.48.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T01:58:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:45:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12726, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.78.46.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:00:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:00:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 854, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.152.52.86", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T02:00:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:43:58Z" }, "ports": [ 0, 161, 32815, 27017, 5060, 427, 1900, 53, 162, 177, 9051, 17 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP trap udp", "(port_scan) TCP portscan", "(sip) content length mismatch", "(port_scan) UDP portscan", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 369034, "tags": [ "icmp", "udp", "snmp", "tcp", "snmptrap", "xdmcp" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "107.170.240.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:10:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:20:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1370, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.150.103.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:11:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:09:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2197, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.170.219.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:11:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:11:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 850, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.130", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T02:17:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:18:16Z" }, "ports": [ 0, 80, 177, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "X11 xdmcp info query", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 10621, "tags": [ "icmp", "alert", "tcp", "http", "udp", "xdmcp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "64.62.197.56", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:21:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:57:40Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20553, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.234.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:22:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:44:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.136", "classifications": [ "Attempted Information Leak", "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-27T02:22:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:52:40Z" }, "ports": [ 177, 0, 69 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get" ], "sightings": 50278, "tags": [ "udp", "xdmcp", "icmp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "211.253.171.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:23:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:23:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 848, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.190.236.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:28:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:10:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1614, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:28:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:47:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6008, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.238.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:29:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:15:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1646, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.247.225.7", "classifications": [], "first_seen": { "$date": "2023-01-27T02:30:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:05:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 1387, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "165.227.228.212", "classifications": [], "first_seen": { "$date": "2023-01-27T02:17:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:49:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 72", "ET SCAN Potential SSH Scan" ], "sightings": 364, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "150.230.213.11", "classifications": [], "first_seen": { "$date": "2023-01-27T02:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:33:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1275, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.76.169.138", "classifications": [], "first_seen": { "$date": "2023-01-27T02:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:12:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 170" ], "sightings": 19009, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "137.184.95.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:18:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:02:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26701, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "149.7.16.55", "classifications": [], "first_seen": { "$date": "2023-01-27T02:19:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:15:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 51", "ET SCAN Potential SSH Scan" ], "sightings": 13328, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "175.140.139.145", "classifications": [], "first_seen": { "$date": "2023-01-27T02:19:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:15:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81" ], "sightings": 19008, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.255.13.242", "classifications": [], "first_seen": { "$date": "2023-01-27T02:19:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:35:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2550, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "168.138.7.117", "classifications": [], "first_seen": { "$date": "2023-01-27T02:20:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:20:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 77" ], "sightings": 319, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.79.146.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:20:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:15:03Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 165", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31636, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "104.248.253.245", "classifications": [], "first_seen": { "$date": "2023-01-27T02:21:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:21:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12" ], "sightings": 319, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.70.74.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:22:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:23:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 20", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 10427, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "152.32.156.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:35:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:35:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.210", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T02:36:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:01:59Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 9380, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.149.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:39:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:54:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14811, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.183.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:39:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:39:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1692, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.111.197", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T02:41:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:38:29Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 13657, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.152.15", "classifications": [], "first_seen": { "$date": "2023-01-27T02:42:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:32:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105", "ET SCAN Potential SSH Scan" ], "sightings": 13827, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "201.91.155.98", "classifications": [], "first_seen": { "$date": "2023-01-27T02:42:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:46:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9399, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "36.91.38.31", "classifications": [], "first_seen": { "$date": "2023-01-27T02:43:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:39:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 140" ], "sightings": 8978, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "24.199.110.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:40:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 67106, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.4.92.212", "classifications": [], "first_seen": { "$date": "2023-01-27T02:44:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:44:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49" ], "sightings": 318, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "77.20.117.212", "classifications": [], "first_seen": { "$date": "2023-01-27T02:44:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:44:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 318, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.227.166.247", "classifications": [], "first_seen": { "$date": "2023-01-27T02:44:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:11:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 72", "ET SCAN Potential SSH Scan" ], "sightings": 12661, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.79.56.117", "classifications": [], "first_seen": { "$date": "2023-01-27T02:45:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:00:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2846, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "196.189.124.186", "classifications": [], "first_seen": { "$date": "2023-01-27T02:46:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:59:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2214, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "14.33.60.245", "classifications": [], "first_seen": { "$date": "2023-01-27T02:46:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:46:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 7" ], "sightings": 318, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.221.173.228", "classifications": [], "first_seen": { "$date": "2023-01-27T02:46:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:46:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127" ], "sightings": 318, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.99.254.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:47:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:39:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5814, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.119.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:48:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:01:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3797, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.148.60.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:49:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:01:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3797, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.204.171.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:50:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:12:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum" ], "sightings": 1451, "tags": [ "tcp", "ssh", "alert", "libssh-0.6.3" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.254.15", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T02:52:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:27:02Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 1675, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.94.138.111", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T02:54:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:02:06Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 62431, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "165.227.185.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T02:54:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:06:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1676, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.27", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T02:57:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:38:28Z" }, "ports": [ 0, 161, 1434, 1900, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 36961, "tags": [ "icmp", "udp", "snmp", "ssh", "tcp", "ZGrab" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "125.228.112.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T02:58:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:58:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 844, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.220.110", "classifications": [], "first_seen": { "$date": "2023-01-27T02:47:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:59:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 43" ], "sightings": 11637, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.242.33.206", "classifications": [], "first_seen": { "$date": "2023-01-27T02:47:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:47:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 316, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "164.92.66.116", "classifications": [], "first_seen": { "$date": "2023-01-27T02:48:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:48:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 68" ], "sightings": 316, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "179.110.163.159", "classifications": [], "first_seen": { "$date": "2023-01-27T02:54:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T02:54:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 316, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "65.49.20.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:27:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27038, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.242.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 842, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.204.196.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:01:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:01:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 842, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.198.51", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:03:12Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:02:30Z" }, "ports": [ 161, 0, 53 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 4980, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.197.5", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:03:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:03:14Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1263, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "188.166.247.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:04:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:20:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3786, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.19.191.106", "classifications": [], "first_seen": { "$date": "2023-01-27T03:05:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:05:24Z" }, "ports": [ 52545 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 421, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "152.32.201.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:07:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:07:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 842, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.75", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T03:08:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:26:22Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 9061, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.236.14", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T03:09:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:53:36Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 13266, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "79.163.138.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:10:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:10:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 842, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.222", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-27T03:11:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:22:38Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 10602, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.247.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:12:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:58:18Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 40095, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.132.53.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:15:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:19:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1682, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.139.17", "classifications": [], "first_seen": { "$date": "2023-01-27T03:11:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:11:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 315, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "206.217.131.233", "classifications": [], "first_seen": { "$date": "2023-01-27T03:16:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:16:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 123" ], "sightings": 315, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.93.54", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:19:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:08:57Z" }, "ports": [ 53, 0, 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 4059, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.105.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:19:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:34:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12297, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "168.126.167.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:19:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:11:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1428, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.238.18", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:24:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:27:57Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1270, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.21", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-27T03:24:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:12:06Z" }, "ports": [ 0, 111 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 852, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "59.126.60.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:24:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:26:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 840, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.24.249.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:26:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:26:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 840, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.147", "classifications": [], "first_seen": { "$date": "2023-01-27T03:28:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:28:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 420, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "116.181.18.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:29:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:50:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 10157, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "121.166.238.76", "classifications": [], "first_seen": { "$date": "2023-01-27T03:23:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:23:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 314, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "180.190.241.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:32:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:42:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2509, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:33:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:35:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2075, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.65.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:33:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:46:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 5852, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.81.9.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:33:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:23:01Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 123", "ET SCAN Potential SSH Scan" ], "sightings": 74863, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.210.77", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T03:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:45:19Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 2718, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:39:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:27:58Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 35405, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "74.82.47.44", "classifications": [], "first_seen": { "$date": "2023-01-27T03:39:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:39:19Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 418, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.135.130.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T03:39:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T03:39:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 836, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.113.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:54:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:51:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.19", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-27T03:57:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:50:35Z" }, "ports": [ 0, 111, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "(stream_tcp) data on SYN packet" ], "sightings": 23169, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "149.5.172.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T03:58:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:26:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8750, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.149.87.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T04:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:03:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 832, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.250.50.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T04:06:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:06:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 832, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.232.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T04:07:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:08:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1664, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.59", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:07:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:30:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8779, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "167.248.133.141", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:13:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:58:15Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28174, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "118.171.36.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T04:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:14:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 832, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:15:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:05:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 836, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.172.163", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:20:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:20:18Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1660, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.59.90.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:25:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:25:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 830, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:26:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:47:09Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 9467, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "134.122.20.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T04:26:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:43:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 30", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13196, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.131.27.221", "classifications": [], "first_seen": { "$date": "2023-01-27T04:26:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:16:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 145", "ET SCAN Potential SSH Scan" ], "sightings": 24122, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "181.113.21.163", "classifications": [], "first_seen": { "$date": "2023-01-27T04:27:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:59:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2510, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.101.140.26", "classifications": [], "first_seen": { "$date": "2023-01-27T04:27:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:27:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 163" ], "sightings": 310, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "98.243.72.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T04:28:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:17:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16847, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.144.51.254", "classifications": [], "first_seen": { "$date": "2023-01-27T04:29:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:31:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102" ], "sightings": 7982, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.172.134.77", "classifications": [], "first_seen": { "$date": "2023-01-27T04:31:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:31:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 310, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.188.233.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T04:34:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:35:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 828, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.214.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:40:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:43:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3352, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:42:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:00:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.128.117.5", "classifications": [], "first_seen": { "$date": "2023-01-27T04:33:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:33:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102" ], "sightings": 5528, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.248.232.60", "classifications": [], "first_seen": { "$date": "2023-01-27T04:39:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:39:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 309, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "144.91.111.145", "classifications": [], "first_seen": { "$date": "2023-01-27T04:53:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:53:04Z" }, "ports": [ 5439 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 413, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.141.26.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:57:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:00:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.160.223.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:57:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:57:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 826, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.229.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T04:58:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T04:58:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 826, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.172.35.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T05:05:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:05:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "185.132.53.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T05:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:09:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 824, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.191.11.52", "classifications": [], "first_seen": { "$date": "2023-01-27T05:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:14:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 918, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "8.222.128.178", "classifications": [], "first_seen": { "$date": "2023-01-27T05:14:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:19:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 182" ], "sightings": 521, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.12.193.109", "classifications": [], "first_seen": { "$date": "2023-01-27T05:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:28:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 169", "ET 3CORESec Poor Reputation IP group 38" ], "sightings": 11853, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "79.9.37.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:14:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:33:33Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 179", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90367, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.77.11.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:16:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:38:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12204, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.240.248", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-27T05:17:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:02:05Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2049, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.172.146.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:19:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:01:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12263, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.51.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:19:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:32:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3282, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.111.0.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:21:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:11:49Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28669, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.150.223", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T05:28:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:28:36Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1230, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.100", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-27T05:28:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:52:17Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 19779, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "65.49.20.87", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-27T05:39:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:28:03Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 8596, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "106.75.169.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T05:43:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:31:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.153", "classifications": [ "Executable code was detected", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T05:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:05:13Z" }, "ports": [ 80, 22, 53, 0, 161, 5632 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response" ], "sightings": 18951, "tags": [ "alert", "tcp", "http", "ssh", "udp", "icmp", "snmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "192.241.157.126", "classifications": [], "first_seen": { "$date": "2023-01-27T05:35:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:35:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105" ], "sightings": 304, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.129.93.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:46:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:41:25Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 8053, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.150.104.174", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T05:46:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:17:13Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8205, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.147", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T05:47:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:20:18Z" }, "ports": [ 0, 53, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 28414, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "178.62.203.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:48:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:01:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3256, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.163.189.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:49:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:54:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12133, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.35.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:50:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:01:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2848, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "191.243.56.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:50:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:43:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7632, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.141.253.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:50:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:50:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 407, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.64.135.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:51:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:29:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 158", "ET SCAN Potential SSH Scan" ], "sightings": 8988, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "27.6.218.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T05:51:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:51:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 814, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "168.181.51.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:51:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:50:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12137, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.126.254.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:55:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:55:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 814, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.72.171.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T05:57:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:58:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 814, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.92.105.51", "classifications": [], "first_seen": { "$date": "2023-01-27T05:52:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T05:52:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 59" ], "sightings": 303, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.116.194.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:05:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:05:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 812, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.79", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T06:14:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:15:04Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 2245, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "60.121.172.127", "classifications": [], "first_seen": { "$date": "2023-01-27T06:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:06:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 302, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "71.26.99.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:17:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:17:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 808, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T06:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 808, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.193.74.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:28:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T18:34:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1338, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.243.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T06:29:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:29:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 808, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.59.186.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:32:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:32:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 806, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.203.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:34:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:36:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 806, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.186.170.213", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T06:34:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:16:13Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50718, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "152.32.144.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T06:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:01:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1544, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.250.31.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:37:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:37:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 806, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.29", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-27T06:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:04:28Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1213, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "180.224.212.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:44:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 806, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.121.93.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:44:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:54:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12189, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.224.169.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:41:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:43:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 302, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.111.224.128", "classifications": [], "first_seen": { "$date": "2023-01-27T06:42:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:28:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 181" ], "sightings": 11033, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.84.174.241", "classifications": [], "first_seen": { "$date": "2023-01-27T06:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:57:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 96" ], "sightings": 11016, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.79.175.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:43:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:56:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3752, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.41.9.133", "classifications": [], "first_seen": { "$date": "2023-01-27T06:46:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:46:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 300, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "184.105.247.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T06:47:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:56:10Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 33524, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.167.66.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T06:47:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:47:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 804, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T06:49:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:49:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.186.24.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:50:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:50:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 804, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.215.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:54:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:54:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 804, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.60.214.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:55:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T06:55:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 804, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.152.52.137", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T06:58:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:00:03Z" }, "ports": [ 0, 162, 2483, 161, 9200, 49182, 53, 5060, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap udp", "(port_scan) TCP portscan", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "(port_scan) UDP portscan", "PROTOCOL-DNS named version attempt", "(sip) content length mismatch", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 62650, "tags": [ "icmp", "udp", "snmptrap", "tcp", "snmp" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "125.228.33.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T06:58:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:07:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2426, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.217.241.82", "classifications": [], "first_seen": { "$date": "2023-01-27T07:00:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:00:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 299, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.235.24.14", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-27T07:03:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:15:12Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 53304, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "88.248.102.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:04:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:04:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 800, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.150.105.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T07:11:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:11:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 800, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.90.30.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T07:13:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:13:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 800, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.91", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-27T07:15:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:33:24Z" }, "ports": [ 0, 161, 177, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "X11 xdmcp info query", "PROTOCOL-TFTP Get" ], "sightings": 70403, "tags": [ "icmp", "udp", "snmp", "xdmcp", "tftp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "121.151.196.172", "classifications": [], "first_seen": { "$date": "2023-01-27T07:10:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:10:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 298, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "85.62.218.82", "classifications": [], "first_seen": { "$date": "2023-01-27T07:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:01:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 184" ], "sightings": 17764, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "133.130.99.35", "classifications": [], "first_seen": { "$date": "2023-01-27T07:16:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:18:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 30", "ET SCAN Potential SSH Scan" ], "sightings": 11830, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "64.62.197.79", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T07:17:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:39:36Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 26940, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "152.32.150.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T07:18:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:18:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 798, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.100.132.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:19:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:20:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1596, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.68.115", "classifications": [], "first_seen": { "$date": "2023-01-27T07:22:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:22:00Z" }, "ports": [ 3389 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 399, "tags": [ "tcp", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.193.57.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T07:23:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:23:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1596, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.127", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-27T07:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:35:30Z" }, "ports": [ 0, 22, 69 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-TFTP Get" ], "sightings": 11711, "tags": [ "icmp", "alert", "tcp", "ssh", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.152.185.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:28:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:28:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 798, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.168.43.240", "classifications": [], "first_seen": { "$date": "2023-01-27T07:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 10" ], "sightings": 297, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.5.177.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:23:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:59:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 25", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18696, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.216.137.50", "classifications": [], "first_seen": { "$date": "2023-01-27T07:29:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:29:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 297, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.62.191.231", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T07:32:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:52:41Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 35989, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "222.103.122.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:32:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:33:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 796, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.171.204.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:33:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:33:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 796, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.155", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T07:50:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:17:31Z" }, "ports": [ 0, 5632, 1900, 1434, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "INDICATOR-SCAN UPnP service discover attempt", "SQL ping attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 53531, "tags": [ "icmp", "udp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "13.76.164.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:55:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:40:42Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 20697, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.149.46.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:57:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:11:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3164, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.87.209.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:57:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T01:28:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 812, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.132.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:57:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:27:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2628, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.199.73.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:58:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:06:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 792, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.157.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T07:58:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:29:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1515, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.113.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T07:59:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:40:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 131" ], "sightings": 3249, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.211.20.219", "classifications": [], "first_seen": { "$date": "2023-01-27T07:56:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T07:56:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 295, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.164.63.216", "classifications": [], "first_seen": { "$date": "2023-01-27T08:01:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:01:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 295, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.211.223.71", "classifications": [], "first_seen": { "$date": "2023-01-27T08:01:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:01:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 295, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.135.26.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:03:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:04:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 790, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.166.244.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T08:05:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:14:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1373, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T08:10:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:24:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.129", "classifications": [ "Misc activity", "Potentially Bad Traffic", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T08:15:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:29:34Z" }, "ports": [ 0, 69, 1434, 177, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "SQL ping attempt", "X11 xdmcp info query", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 10848, "tags": [ "icmp", "udp", "tftp", "xdmcp" ], "rule_count": 6, "classification_count": 4 }, { "ioc": "183.82.34.122", "classifications": [], "first_seen": { "$date": "2023-01-27T08:14:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:10:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 91" ], "sightings": 17503, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.253.133.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:15:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:03:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21471, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.175.174.114", "classifications": [], "first_seen": { "$date": "2023-01-27T08:16:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:34:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2932, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "106.12.172.93", "classifications": [], "first_seen": { "$date": "2023-01-27T08:16:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:47:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 82591, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "89.250.148.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:16:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:16:09Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25179, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.164.114.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:19:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:19:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 788, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.91.223.160", "classifications": [], "first_seen": { "$date": "2023-01-27T08:26:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:26:45Z" }, "ports": [ 7610, 26094 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 788, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "138.197.66.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:17:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:17:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15655, "tags": [ "alert", "tcp", "ssh", "anomaly", "libssh_0.9.6" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "46.101.254.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:18:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:43:40Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 160", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41801, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "105.96.11.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:18:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:52:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 787, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "197.5.145.30", "classifications": [], "first_seen": { "$date": "2023-01-27T08:19:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:19:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 110" ], "sightings": 293, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.155.159.62", "classifications": [], "first_seen": { "$date": "2023-01-27T08:20:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:20:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1172, "tags": [ "alert", "tcp", "ssh", "anomaly", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "79.127.36.98", "classifications": [], "first_seen": { "$date": "2023-01-27T08:21:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:28:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 179", "ET 3CORESec Poor Reputation IP group 43" ], "sightings": 1019, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "2.195.233.189", "classifications": [], "first_seen": { "$date": "2023-01-27T08:21:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:22:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 586, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "222.24.63.126", "classifications": [], "first_seen": { "$date": "2023-01-27T08:23:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:23:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 586, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "178.88.161.82", "classifications": [], "first_seen": { "$date": "2023-01-27T08:30:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:35:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 19628, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "23.137.104.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T08:31:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:37:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1351, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "44.205.5.47", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T08:32:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:44:42Z" }, "ports": [ 143, 162, 2000, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 1592, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "44.203.170.255", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T08:33:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:34:04Z" }, "ports": [ 161, 2054 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp", "(port_scan) TCP portscan" ], "sightings": 786, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.25.55.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T08:33:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:33:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1965, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "195.133.40.88", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T08:41:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:05:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3833, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.81.228.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T08:42:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:42:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 786, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.99.14.158", "classifications": [], "first_seen": { "$date": "2023-01-27T08:38:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:36:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 852, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.134.144.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T08:47:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:48:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1568, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.34.94.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:55:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:55:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 784, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.218.165.182", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T08:57:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:23:51Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 28972, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.106.167.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:59:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:00:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 784, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.97.1.48", "classifications": [], "first_seen": { "$date": "2023-01-27T08:53:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T08:53:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 873, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.138.148.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T08:58:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:53:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 299, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.22.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:08:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:25:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4295, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.36.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:08:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:25:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 35" ], "sightings": 3913, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.118.160.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:09:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:17:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10452, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.187.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:09:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:46:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 33", "ET 3CORESec Poor Reputation IP group 12", "ET SCAN Potential SSH Scan" ], "sightings": 3164, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "143.198.139.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:10:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:26:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3513, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.212.146.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:11:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:11:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 782, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.213.197.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:11:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:19:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1172, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.244.166.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:12:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:19:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2343, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.56.173.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:14:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:14:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 782, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.226.235.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:15:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:15:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 782, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.69", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T09:18:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:43:07Z" }, "ports": [ 0, 161, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "(stream_tcp) data on SYN packet" ], "sightings": 107286, "tags": [ "icmp", "udp", "snmp", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "41.239.94.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T09:18:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:18:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 780, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.145", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan", "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:22:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:26:06Z" }, "ports": [ 161, 0, 5632, 80, 53, 1900, 22 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49583, "tags": [ "udp", "snmp", "icmp", "alert", "tcp", "http", "ssh" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "114.35.101.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:23:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:23:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 780, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.85.181.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:24:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:25:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 780, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.162.75.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:25:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:42:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2721, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.109.199.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:25:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:27:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 12866, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.253.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:25:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:40:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31019, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.30.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:26:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:12:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11594, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.196.245.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:26:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:41:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3109, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.196.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:27:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:19:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 33", "ET 3CORESec Poor Reputation IP group 12", "ET SCAN Potential SSH Scan" ], "sightings": 99489, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "128.199.185.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:27:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:41:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3109, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.75.249.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:27:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:57:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7749, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.170.215.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:28:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:41:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3109, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.36.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:28:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:00:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18580, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.83.27.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:29:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:09:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3196, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "39.102.228.16", "classifications": [], "first_seen": { "$date": "2023-01-27T09:25:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:32:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 599, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "38.229.62.9", "classifications": [], "first_seen": { "$date": "2023-01-27T09:32:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:32:38Z" }, "ports": [ 60260 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 389, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.128.237.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:38:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:39:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 776, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.105", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T09:42:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:04:52Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 12076, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.247.234", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-27T09:47:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:47:26Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1160, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "71.6.165.200", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T09:49:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:57:42Z" }, "ports": [ 0, 161, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 51573, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "86.57.167.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T09:52:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T09:52:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1930, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "167.99.126.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T09:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:07:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3075, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.220.18", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T09:58:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:08:36Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1879, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "182.61.42.1", "classifications": [], "first_seen": { "$date": "2023-01-27T09:54:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:12:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 30688, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "192.241.195.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T10:00:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:44:56Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30552, "tags": [ "alert", "tcp", "ssh", "anomaly", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "121.151.102.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:01:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:02:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 768, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.63.203.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:02:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:02:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 384, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.213.226.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:04:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:04:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1536, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.44.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:06:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:06:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 768, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.40.57.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T10:10:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:10:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 768, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.5.234.68", "classifications": [], "first_seen": { "$date": "2023-01-27T10:03:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:03:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 59" ], "sightings": 572, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "82.81.207.46", "classifications": [], "first_seen": { "$date": "2023-01-27T10:15:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:16:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 81" ], "sightings": 858, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "109.75.45.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:23:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:00:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 4" ], "sightings": 1968, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "156.196.254.211", "classifications": [], "first_seen": { "$date": "2023-01-27T10:18:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:18:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 570, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.83.67.220", "classifications": [], "first_seen": { "$date": "2023-01-27T10:30:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:30:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 570, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "190.171.189.85", "classifications": [], "first_seen": { "$date": "2023-01-27T10:31:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T06:06:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 1305, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.228.163.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:32:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:32:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 764, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.64.146.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:38:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:52:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2670, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.87.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:38:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:53:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3433, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.22.197.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:38:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:38:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 382, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.65.23.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:38:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:27:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11362, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.150.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T10:38:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:28:16Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3166, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "220.76.92.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:39:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:39:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 382, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.0.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:41:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:53:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2670, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.229.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T10:41:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:36:44Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4975, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "182.59.139.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:41:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:20:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7229, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.41.47.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:42:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:55:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2287, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.27.95.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:43:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:01:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.221.85.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:33:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:11:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5084, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.45.59.193", "classifications": [], "first_seen": { "$date": "2023-01-27T10:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:35:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 8", "ET 3CORESec Poor Reputation IP group 13" ], "sightings": 1420, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "220.132.219.58", "classifications": [], "first_seen": { "$date": "2023-01-27T10:39:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:39:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 568, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.133.78.124", "classifications": [], "first_seen": { "$date": "2023-01-27T10:49:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:49:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 283, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "157.230.107.204", "classifications": [], "first_seen": { "$date": "2023-01-27T10:57:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:12:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2540, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "205.185.123.158", "classifications": [], "first_seen": { "$date": "2023-01-27T10:58:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T10:58:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 121", "ET 3CORESec Poor Reputation IP group 27" ], "sightings": 566, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "78.153.130.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T10:59:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:22:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6168, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.183.128.237", "classifications": [], "first_seen": { "$date": "2023-01-27T11:00:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:04:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 167" ], "sightings": 10386, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.90.5.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:03:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:03:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 760, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.207.91.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:05:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:57:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15340, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.5.132.169", "classifications": [], "first_seen": { "$date": "2023-01-27T11:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:06:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) partial start line" ], "sightings": 1520, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "107.155.60.213", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T11:11:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:54:14Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 1523, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "161.35.182.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:13:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:18:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14021, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.134.144.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:13:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:52:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.56.17.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:22:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:59:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1830, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.220.47.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:09:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 126", "ET SCAN Potential SSH Scan" ], "sightings": 7852, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.246.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:28:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:08:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 910, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.51.84.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:33:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:44:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 169" ], "sightings": 2275, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.209.67.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:33:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:35:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31569, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.172.150.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:33:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:55:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 74" ], "sightings": 15056, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.177.136.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:35:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:45:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3024, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.208.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:35:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:28:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15051, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.150.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:36:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:36:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 756, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.217.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:44:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:36:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18874, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.38.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:44:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:20:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15313, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.159.234.75", "classifications": [], "first_seen": { "$date": "2023-01-27T11:32:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:32:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 280, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.241.228.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T11:47:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:39:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3350, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.165.211.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:48:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:02:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3015, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "163.197.47.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:49:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:01:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3015, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.53.174.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:49:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:04:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3013, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.139.244.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:51:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:40:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9548, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.216.211.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:52:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:41:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 75301, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.239.68.195", "classifications": [], "first_seen": { "$date": "2023-01-27T11:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T11:53:11Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 1131, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "189.135.132.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:53:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:13:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3753, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.210.35", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T11:53:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:51:52Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 14620, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "138.68.55.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:55:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:14:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38154, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.5.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:55:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:07:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3006, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.211.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:56:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:10:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2253, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.171.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:56:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:05:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 83", "ET 3CORESec Poor Reputation IP group 19" ], "sightings": 11329, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "220.80.223.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:58:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:07:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 132", "ET SCAN Potential SSH Scan" ], "sightings": 28073, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.87.96.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T11:48:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:46:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 40", "ET 3CORESec Poor Reputation IP group 12", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13740, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.154.180.119", "classifications": [], "first_seen": { "$date": "2023-01-27T11:53:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:04:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1943, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "160.153.252.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:05:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:27:36Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 63", "ET SCAN Potential SSH Scan" ], "sightings": 3731, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.129.177.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:19:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2616, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.74.208.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:07:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:32:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 171" ], "sightings": 2620, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:07:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T11:00:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9670, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.247.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:07:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:12:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.71.58.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:11:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:11:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 748, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.191.46.128", "classifications": [], "first_seen": { "$date": "2023-01-27T12:11:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:11:49Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 374, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.240.20", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T12:15:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:15:25Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 374, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.143", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-27T12:12:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:19:19Z" }, "ports": [ 22, 0, 80, 69 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "PROTOCOL-TFTP Get" ], "sightings": 10843, "tags": [ "alert", "tcp", "ssh", "icmp", "http", "udp", "tftp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "162.243.150.12", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:17:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:37:46Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34515, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.59", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:18:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:52:30Z" }, "ports": [ 53, 0, 80, 161 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 8413, "tags": [ "udp", "icmp", "alert", "tcp", "http", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "169.197.113.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:19:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:19:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.172.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:20:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:04:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.13.218.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:22:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:40:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 43432, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.236.224.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:24:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:24:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 746, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.8.127.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:25:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:26:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 746, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.91.80.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:28:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:28:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 746, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "67.207.90.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:31:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:22:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14016, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.89.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:22:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:22:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 838, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.229.65.162", "classifications": [], "first_seen": { "$date": "2023-01-27T12:29:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:35:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 120885, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "64.130.116.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:40:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:41:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 744, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.172.236.213", "classifications": [], "first_seen": { "$date": "2023-01-27T12:38:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:38:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 273, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.154.12.171", "classifications": [], "first_seen": { "$date": "2023-01-27T12:43:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:02:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 156" ], "sightings": 10280, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "189.148.125.47", "classifications": [], "first_seen": { "$date": "2023-01-27T12:45:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 273, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "121.159.211.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T12:48:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:49:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 742, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.178.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T12:59:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:23:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15298, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.192.136.43", "classifications": [], "first_seen": { "$date": "2023-01-27T12:59:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:59:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 186" ], "sightings": 272, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "179.70.230.3", "classifications": [], "first_seen": { "$date": "2023-01-27T12:59:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T12:59:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 87" ], "sightings": 272, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.155.168.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:01:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:15:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1289, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.150.103.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T13:05:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:05:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 740, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.168.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:08:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:08:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 740, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.226.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:11:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:59:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146" ], "sightings": 896, "tags": [ "tcp", "ssh", "alert", "libssh-0.6.3" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.40.220.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:11:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:43:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25343, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.236.182.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:11:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:26:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2953, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.158.181.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:12:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:12:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 370, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.96.227.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:04:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:32:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9163, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.148.215.114", "classifications": [], "first_seen": { "$date": "2023-01-27T13:06:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:06:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 271, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.154.225.96", "classifications": [], "first_seen": { "$date": "2023-01-27T13:12:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:32:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2702, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "102.50.251.51", "classifications": [], "first_seen": { "$date": "2023-01-27T13:12:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:27:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 1", "ET 3CORESec Poor Reputation IP group 1", "ET SCAN Potential SSH Scan" ], "sightings": 10654, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "85.234.116.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:15:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:47:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 44", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5780, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.227.19.195", "classifications": [], "first_seen": { "$date": "2023-01-27T13:16:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:33:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4872, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "165.22.38.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T13:18:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:25:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14542, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.223.178.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T13:31:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:16:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15832, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.97.131.10", "classifications": [], "first_seen": { "$date": "2023-01-27T13:22:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:22:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 270, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "124.222.56.136", "classifications": [], "first_seen": { "$date": "2023-01-27T13:30:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:35:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 21313, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "103.97.178.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T13:41:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:41:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 736, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.124.249.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T13:45:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:45:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 736, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.250.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:45:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:46:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 735, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.14.225.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T13:45:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:26:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1246, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.16.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:44:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:44:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1072, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.6.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:48:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:01:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3288, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.179.126.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:48:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:01:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2557, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.143.130.124", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T13:48:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:36:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 89082, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "147.182.190.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:48:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:22:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 50", "ET SCAN Potential SSH Scan" ], "sightings": 6571, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.74.5.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:50:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:40:44Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 94", "ET SCAN Potential SSH Scan" ], "sightings": 59808, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.240.110.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:50:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:32:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2259, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.147.130", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-27T13:51:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:02:21Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1810, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.94.138.104", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T13:53:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:48:10Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 39793, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.150.14.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:56:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:56:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 730, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.184.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T14:00:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:13:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14543, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.118.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T13:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T13:50:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 796, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.124.114.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:05:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:05:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 726, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.245.86.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T14:06:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:06:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 726, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.68.63.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:08:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:14:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 186" ], "sightings": 2802, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.120.69.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:09:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:08:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3270, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.128.65.145", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T14:15:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:03:18Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 3472, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.27.220.87", "classifications": [], "first_seen": { "$date": "2023-01-27T14:06:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:06:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 267, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.253.117.156", "classifications": [], "first_seen": { "$date": "2023-01-27T14:08:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:50:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 746, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.235.24.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T14:20:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T18:43:48Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 9847, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "90.146.220.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T14:22:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:22:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 724, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.198.219.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:24:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:05:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 985, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.35.51.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:27:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:28:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 724, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.210.53.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:32:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:34:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18819, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.134.19.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:33:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:51:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2885, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.171.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:33:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:54:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6084, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.225.70.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:34:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:47:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2887, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.39.97.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:35:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:33:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20236, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.248.80.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:36:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:50:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2886, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.98.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:36:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:12:50Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 84", "ET SCAN Potential SSH Scan" ], "sightings": 24778, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "20.197.3.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:37:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:57:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 116", "ET SCAN Potential SSH Scan" ], "sightings": 6591, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.3.240.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:39:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:52:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1442, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "106.105.111.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:39:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:40:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 722, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.39.216.155", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T14:41:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:41:40Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 361, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.237.98.235", "classifications": [], "first_seen": { "$date": "2023-01-27T14:42:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:44:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 47108, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.243.128.9", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-27T14:44:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:19:05Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2997, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.228.11", "classifications": [ "Decode of an RPC Query", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T14:44:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:03:06Z" }, "ports": [ 111, 0, 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 2823, "tags": [ "udp", "sunrpc", "portmapper", "icmp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "121.36.63.70", "classifications": [], "first_seen": { "$date": "2023-01-27T14:34:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:40:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 10946, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "178.251.140.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:37:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:22:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3033, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.55.177.114", "classifications": [], "first_seen": { "$date": "2023-01-27T14:37:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:37:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 78" ], "sightings": 265, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "190.131.255.12", "classifications": [], "first_seen": { "$date": "2023-01-27T14:38:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:38:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 24" ], "sightings": 265, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "154.68.39.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:40:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:46:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 53", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10510, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.151.241", "classifications": [], "first_seen": { "$date": "2023-01-27T14:40:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T01:58:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61", "ET SCAN Potential SSH Scan" ], "sightings": 10316, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "42.82.38.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:51:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:52:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 720, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.39.39.82", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T14:55:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:55:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1800, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "152.32.228.20", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-27T14:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:56:11Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1080, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "161.35.182.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T14:57:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:29:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14525, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.11.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:58:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:59:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 720, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.67.195.191", "classifications": [], "first_seen": { "$date": "2023-01-27T14:50:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:54:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 19199, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "109.161.96.68", "classifications": [], "first_seen": { "$date": "2023-01-27T14:53:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:13:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2624, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "190.120.254.76", "classifications": [], "first_seen": { "$date": "2023-01-27T14:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:54:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102" ], "sightings": 263, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.205.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:55:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T01:31:56Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 76716, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "40.76.205.168", "classifications": [], "first_seen": { "$date": "2023-01-27T14:55:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:02:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 142" ], "sightings": 10272, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "213.209.114.26", "classifications": [], "first_seen": { "$date": "2023-01-27T14:56:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:56:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 129" ], "sightings": 263, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.45.248.227", "classifications": [], "first_seen": { "$date": "2023-01-27T14:57:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:11:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2099, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "219.85.57.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T14:58:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T14:58:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1749, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "147.10.254.230", "classifications": [], "first_seen": { "$date": "2023-01-27T15:00:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:00:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49" ], "sightings": 263, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.201.73.216", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44390, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.67.208.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:02:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-ICMP PING BSDtype", "PROTOCOL-ICMP PING Unix", "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1795, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "104.225.129.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43758, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "152.32.159.252", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:15:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43592, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.148.92.176", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:19:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43805, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.76.242.138", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:18:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45845, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.80.210.39", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:18:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44936, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.213.22.247", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:35:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43780, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "168.235.89.145", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:02:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:03:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7160, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "221.229.214.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:03:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45609, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "112.73.93.51", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:03:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:30:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45795, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.125.190.56", "classifications": [], "first_seen": { "$date": "2023-01-27T15:03:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:06:16Z" }, "ports": [ 52663, 42018, 54068, 35627, 51641, 54875, 57362, 39958, 44698, 47606, 49962, 33570, 35037, 34977, 53925, 46193, 52395, 51900, 39880, 45246, 50564, 52824, 45513, 47880, 50864, 46662, 57237, 53450, 33432, 47819, 57937, 34950, 33331 ], "reporting_nodes": 2, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 17088, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "223.244.19.128", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:03:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:17:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43848, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "112.73.92.167", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:03:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:12:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 46177, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.188.157.200", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:03:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44231, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.128.144.40", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:03:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:56:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36480, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "152.32.201.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:03:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:03:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 712, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "208.123.119.244", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:04:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:12:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44325, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.199.18.120", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:04:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:19:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43172, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "152.32.163.90", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:04:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:16:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45363, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.71.130.102", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:04:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43987, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "1.13.3.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:04:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:30:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36691, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.183.41.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:04:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:20:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3131, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "155.138.134.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:14:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45775, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "183.98.20.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:57:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 91" ], "sightings": 12766, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.126.238.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:14:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44849, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "219.249.204.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:05:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:19:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2788, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.238.78.67", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:05:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:45:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37311, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "208.115.223.122", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:05:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44760, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "112.187.12.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:05:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:05:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2878, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.44.193.123", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:05:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:28:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43406, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "94.153.212.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:05:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:25:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 188" ], "sightings": 15205, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "102.68.86.115", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:05:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:15:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44709, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "203.29.240.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:05:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:17:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45719, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "67.219.109.52", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:05:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:05:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7110, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "129.232.219.212", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:05:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:59:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36253, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "177.87.224.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:05:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:36:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3616, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.109.216.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:05:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:20:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3130, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.59.59.221", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:06:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:36:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43273, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "93.125.114.249", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:06:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:28:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44977, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "39.109.71.79", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:06:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44971, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "36.99.143.28", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:06:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:24:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44477, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "58.251.56.184", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:15:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44759, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.243.129.37", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:35:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44380, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.143.128.219", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43239, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.154.47.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:07:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:22:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2425, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.45.107.44", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:37:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43003, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "95.179.189.58", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:41:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37710, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "1.248.227.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:07:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:23:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3116, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.221.62.9", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:30:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44399, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.88.125.122", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43140, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.84.164.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:07:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.112.75.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:07:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:12:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.141.159", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:08:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:36:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43551, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "203.156.197.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:08:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:19:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44192, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "208.115.216.137", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:08:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45660, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "111.19.156.28", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:08:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:17:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44718, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "116.42.218.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:08:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:09:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 704, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.77.25.0", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:09:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:09:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.54.38.226", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:09:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:15:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14660, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.143.131.233", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:09:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:21:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44670, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.32.65.84", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:09:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:37:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38240, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.143.130.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:09:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44990, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.180", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:09:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:32:29Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16170, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.238.173.37", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:10:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:28:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44355, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.90.61.8", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:10:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43402, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.72.156.37", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:10:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:30:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43680, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "149.255.35.41", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:10:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:27:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44165, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "138.68.51.158", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:10:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:16:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44618, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.128.144.144", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:10:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43774, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.180.165.238", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:10:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.126.237.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:10:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45068, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.186.78.66", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:27:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43270, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.192.124.207", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:13:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44800, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "80.240.18.169", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:11:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:20:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43362, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "222.186.139.115", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:11:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:14:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44363, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.143.129.235", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:12:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:14:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43437, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.19.3.150", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:12:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44925, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.204.24.58", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:12:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:35:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43324, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.3.163.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:12:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43760, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "109.169.72.114", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:12:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43109, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "58.215.39.154", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:12:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:14:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45140, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "95.179.219.232", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:13:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45088, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.158.28.124", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:13:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:17:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45690, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "66.55.159.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:13:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:26:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45006, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "31.42.186.248", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:13:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45200, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "8.141.235.45", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:13:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43212, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.31.22.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:13:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44101, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.163.230.177", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:13:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:12:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44853, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.185.219.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:14:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:12:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44157, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.244.237.180", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:14:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44868, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.185.113.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:14:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:12:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43772, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "155.138.163.225", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:15:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "145.14.131.214", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.181.209.108", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:20:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44082, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.108.129.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:40:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43414, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.149.239.229", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:15:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:28:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44780, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.242.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:16:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:16:06Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1041, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.43.63.171", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:16:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:36:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "207.148.126.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:16:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:20:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43253, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.187.227.121", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:16:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:26:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44484, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.246.131.130", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:16:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.104.73.107", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:16:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:27:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44625, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.135.177.125", "classifications": [], "first_seen": { "$date": "2023-01-27T15:11:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:11:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 262, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.126.236.245", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:16:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:16:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43356, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "60.245.57.67", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:16:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44577, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "207.148.71.134", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:17:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:17:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6901, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.128.179.20", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:17:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:52:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36703, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "58.213.109.242", "classifications": [], "first_seen": { "$date": "2023-01-27T15:17:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:19:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 681, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "106.58.214.123", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:17:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:19:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44560, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.226.34.233", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:17:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:28:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36285, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.254.19", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T15:17:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:35:59Z" }, "ports": [ 5060, 0, 1900, 1434 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "SQL ping attempt" ], "sightings": 2788, "tags": [ "udp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "81.181.108.92", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:18:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44675, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.152.33.91", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:18:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43275, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.71.244.61", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:18:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:13:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.36.41.129", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:18:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44780, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.42.179.254", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:18:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:15:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43992, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "76.8.60.199", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:18:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:16:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "149.28.59.157", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:18:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:18:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "141.105.71.33", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:18:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44316, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "108.6.214.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:19:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:23:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.234.3.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:20:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:19:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 605, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.123.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:20:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:35:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3074, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "77.222.162.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:21:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:20:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5750, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "196.46.190.58", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:22:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36087, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.103.108.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:22:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:33:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1025, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.113.61.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:23:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:15:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10181, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.75.116.214", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:24:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:15:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45258, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "2.133.218.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:24:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:54:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 4" ], "sightings": 1536, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.248.174.80", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:24:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:30:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44001, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "152.32.247.251", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:24:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45356, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.121.87.145", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:24:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:17:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44675, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "144.202.45.137", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:24:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:26:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44700, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.244.207.180", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:25:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:26:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44532, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "152.32.200.8", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:25:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:35:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44991, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.213.20.161", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:25:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:24:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44154, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "144.202.64.219", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:27:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:19:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44523, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.79.22.227", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:29:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:35:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43913, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.186.79.47", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:29:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:35:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43071, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.230.157.206", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:29:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44895, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.32.130.230", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:29:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:29:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 43620, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.231.233.124", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:29:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45298, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.143.128.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:29:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:14:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 44716, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.116.138.31", "classifications": [], "first_seen": { "$date": "2023-01-27T15:23:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:23:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 522, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.240.2", "classifications": [], "first_seen": { "$date": "2023-01-27T15:32:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:32:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 52" ], "sightings": 522, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.63.228.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:35:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:36:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 680, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.231.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:40:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 680, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.23.206.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:41:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:48:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1213, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.112.75.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:42:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:46:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1339, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.159.4.79", "classifications": [], "first_seen": { "$date": "2023-01-27T15:37:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:37:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 260, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "54.165.17.230", "classifications": [], "first_seen": { "$date": "2023-01-27T15:39:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T02:17:11Z" }, "ports": [ 49578, 49918, 50316, 55310 ], "reporting_nodes": 1, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management" ], "sightings": 5509, "tags": [ "alert", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "119.193.48.56", "classifications": [], "first_seen": { "$date": "2023-01-27T15:43:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:43:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 520, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "196.191.120.250", "classifications": [], "first_seen": { "$date": "2023-01-27T15:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:42:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 109" ], "sightings": 15460, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.153.184.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T15:45:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:06:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 149", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10956, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "121.153.216.202", "classifications": [], "first_seen": { "$date": "2023-01-27T15:47:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:47:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 260, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.138", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T15:47:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:10:49Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 45130, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "116.255.130.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:52:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.171.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:52:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.40.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T15:53:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:29:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14485, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.38", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T15:56:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:40:54Z" }, "ports": [ 5632, 0, 53, 161 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 6127, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "192.241.228.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T16:01:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:01:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "75.145.55.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:01:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:02:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 677, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.155.162.70", "classifications": [], "first_seen": { "$date": "2023-01-27T15:48:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:56:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 152" ], "sightings": 10027, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.227.136.237", "classifications": [], "first_seen": { "$date": "2023-01-27T15:48:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T15:48:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 172" ], "sightings": 259, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.244.25.124", "classifications": [], "first_seen": { "$date": "2023-01-27T15:50:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:26:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139", "ET 3CORESec Poor Reputation IP group 34" ], "sightings": 8792, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "202.4.42.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:09:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:59:58Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 118", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET SCAN Potential SSH Scan" ], "sightings": 67140, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6", "anomaly" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "16.162.58.136", "classifications": [], "first_seen": { "$date": "2023-01-27T16:07:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:02:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7660, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.92.158.68", "classifications": [], "first_seen": { "$date": "2023-01-27T16:07:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:23:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2312, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.72.248.26", "classifications": [], "first_seen": { "$date": "2023-01-27T16:08:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:08:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 516, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "196.28.248.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:08:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:59:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 109", "ET 3CORESec Poor Reputation IP group 25", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18495, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "41.93.32.131", "classifications": [], "first_seen": { "$date": "2023-01-27T16:09:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:23:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 144" ], "sightings": 9430, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "164.92.104.151", "classifications": [], "first_seen": { "$date": "2023-01-27T16:09:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:24:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2569, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "143.244.162.174", "classifications": [], "first_seen": { "$date": "2023-01-27T16:09:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:26:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 46", "ET SCAN Potential SSH Scan" ], "sightings": 308, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "175.196.129.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:09:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:28:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81", "ET 3CORESec Poor Reputation IP group 19", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 22212, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "192.241.149.141", "classifications": [], "first_seen": { "$date": "2023-01-27T16:10:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:10:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105" ], "sightings": 258, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "202.83.17.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:13:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T11:00:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 119", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15929, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.254.0.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:13:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:31:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 189", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9750, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.91.75.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:15:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:45:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 267, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.186.209.102", "classifications": [], "first_seen": { "$date": "2023-01-27T16:17:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:17:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 257, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "92.154.26.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:20:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:20:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 674, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.141.133.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:29:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:46:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1681, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.248.133.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T16:29:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:01:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6368, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.204.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:30:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:19:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10102, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.168.34.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:31:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:56:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1205, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.24.13.75", "classifications": [], "first_seen": { "$date": "2023-01-27T16:26:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:26:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127" ], "sightings": 256, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.238.103.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:30:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:49:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47464, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.126.161.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:35:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:35:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 672, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.208.99.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:40:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:19:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8698, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.157.26.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:06:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20544, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.53.145.214", "classifications": [], "first_seen": { "$date": "2023-01-27T16:44:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:45:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 765, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "177.66.255.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:50:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:50:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 670, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.54.92.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:51:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:52:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 670, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.196.231.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:57:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:25:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1236, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.128.229.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T16:57:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:57:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 670, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.218.120.28", "classifications": [], "first_seen": { "$date": "2023-01-27T16:59:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T16:59:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 254, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "2a05:d018:091c:3200:2846:99fb:81b6:1e11", "classifications": [], "first_seen": { "$date": "2023-01-27T17:00:08Z" }, "ja3": [ "fb4726d465c5f28b84cd6d14cedd13a7" ], "last_seen": { "$date": "2023-06-28T10:59:47Z" }, "ports": [ 44346, 44798, 59842, 41244, 57832, 37382, 33772, 33268, 36494, 47976, 35860 ], "reporting_nodes": 1, "rules": [], "sightings": 1950, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.13.161.124", "classifications": [], "first_seen": { "$date": "2023-01-27T17:00:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:00:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 56" ], "sightings": 508, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.124.97.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:03:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:20:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2669, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.247.213.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:04:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:39:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 336, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T17:04:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:53:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1248, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.24.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:04:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:23:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 76927, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.148.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:04:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:43:26Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 44", "ET 3CORESec Poor Reputation IP group 13", "ET SCAN Potential SSH Scan" ], "sightings": 87510, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "165.22.59.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:05:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:21:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4991, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.243.16.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:06:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:07:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 668, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.157.46.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:06:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:20:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2669, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.254.192.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:07:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63263, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.25.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:19:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2335, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.252.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:07:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:21:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3001, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.103.240.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:07:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:19:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2000, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.90.227.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:09:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:24:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2330, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.162", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T17:10:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:37:44Z" }, "ports": [ 161, 0, 53 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 1917, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "111.161.41.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:12:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:41:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 740, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.37.84.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:06:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:35:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3793, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.95.85.212", "classifications": [], "first_seen": { "$date": "2023-01-27T17:06:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:06:28Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "SURICATA TCP option invalid length" ], "sightings": 759, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.221.72.79", "classifications": [], "first_seen": { "$date": "2023-01-27T17:07:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:12:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 20746, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "137.184.50.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:19:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:35:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3310, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.117.190.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:19:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:25:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 996, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.155.166.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:20:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:29:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9892, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.157.26.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:21:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:09:14Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 154", "ET SCAN Potential SSH Scan" ], "sightings": 79052, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "212.179.12.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:21:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:19:28Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 128", "ET 3CORESec Poor Reputation IP group 29", "ET SCAN Potential SSH Scan" ], "sightings": 47839, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "121.175.233.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:24:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:25:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 664, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.136.194.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:26:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:32:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 10" ], "sightings": 1239, "tags": [ "tcp", "brute_force", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.81.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:27:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:42:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2642, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.117.190.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:33:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:33:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 330, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.201.222.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:38:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:38:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 660, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.90.4.187", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T17:39:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:39:46Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 330, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.127.54.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T17:42:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:42:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 660, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.223.39", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T17:46:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:46:31Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1320, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.229.28.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:39:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:39:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1151, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "178.22.168.219", "classifications": [], "first_seen": { "$date": "2023-01-27T17:45:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:44:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2285, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.134.191.100", "classifications": [], "first_seen": { "$date": "2023-01-27T17:46:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:51:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146", "ET SCAN Potential SSH Scan" ], "sightings": 9670, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "165.22.60.53", "classifications": [], "first_seen": { "$date": "2023-01-27T17:46:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:49:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 71" ], "sightings": 14856, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.230.47.75", "classifications": [], "first_seen": { "$date": "2023-01-27T17:48:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:52:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55" ], "sightings": 9176, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.151.203.161", "classifications": [], "first_seen": { "$date": "2023-01-27T17:48:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:00:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1748, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "217.133.34.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T17:54:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:54:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 987, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.138.117.90", "classifications": [], "first_seen": { "$date": "2023-01-27T17:50:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:07:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 748, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.230.109.212", "classifications": [], "first_seen": { "$date": "2023-01-27T17:56:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T17:56:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 249, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.142.74.61", "classifications": [], "first_seen": { "$date": "2023-01-27T18:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:17:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 22642, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "192.241.230.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T18:11:13Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:36:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3002, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.24.211", "classifications": [], "first_seen": { "$date": "2023-01-27T18:15:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:15:15Z" }, "ports": [ 8081 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 328, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.35.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T18:18:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:18:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1229, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.31.151.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T18:27:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:29:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 654, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.148.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T18:29:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:31:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1816, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.156", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-27T18:35:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:59:32Z" }, "ports": [ 5632, 0, 22, 161 ], "reporting_nodes": 3, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12601, "tags": [ "udp", "icmp", "alert", "tcp", "ssh", "snmp" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "107.170.224.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T18:37:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:58:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1712, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.144.32.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T18:37:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:37:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 652, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.249.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T18:40:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:35:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4763, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.0.55.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T18:40:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:37:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20133, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.246.2.80", "classifications": [], "first_seen": { "$date": "2023-01-27T18:38:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:23:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1727, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.125.188.59", "classifications": [], "first_seen": { "$date": "2023-01-27T18:44:31Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-06-29T15:17:50Z" }, "ports": [ 51888, 51944, 52116, 52216, 52246, 50854, 47930, 58736, 41068, 48282, 44820, 40482, 50962, 50654, 49498, 54736, 54748, 47808, 50284, 38346, 57104, 38278, 60026, 38232, 46430, 56078, 43090, 43952 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 8576, "tags": [ "tls", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "172.104.211.104", "classifications": [], "first_seen": { "$date": "2023-01-27T18:49:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:49:11Z" }, "ports": [ 8008 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 325, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.228.205.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T18:49:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:49:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 650, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.226.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T18:49:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:49:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20097, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.188.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T18:53:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:36:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4404, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.225.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T18:58:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:58:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 650, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.70.30.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:00:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:00:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 650, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.112.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:00:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:00:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 650, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.163.125.84", "classifications": [], "first_seen": { "$date": "2023-01-27T18:50:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T18:50:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 245, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "106.55.29.51", "classifications": [], "first_seen": { "$date": "2023-01-27T18:51:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:09:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 21044, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "185.44.81.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:03:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:58:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15412, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:07:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:07:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.230.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:07:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:07:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.149.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:09:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:59:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3340, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.209.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:13:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:52:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21241, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.148.134.216", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:14:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:40:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 18424, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.113.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:16:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:16:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 650, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.19", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:16:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:39:15Z" }, "ports": [ 1434, 0, 22, 5632 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "APP-DETECT PCAnywhere server response" ], "sightings": 7955, "tags": [ "udp", "icmp", "tcp", "ssh" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "220.132.54.249", "classifications": [], "first_seen": { "$date": "2023-01-27T19:04:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:04:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 244, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "124.187.103.196", "classifications": [], "first_seen": { "$date": "2023-01-27T19:09:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:10:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 732, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.224.15", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T19:19:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:08:53Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 3144, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.109.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:19:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:21:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7533, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.207.101", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T19:20:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:41:02Z" }, "ports": [ 0, 161, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP trap tcp" ], "sightings": 14346, "tags": [ "icmp", "udp", "snmp", "tcp", "snmptrap" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.126.157.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:21:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:22:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 648, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.160.226.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:26:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:30:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9691, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "168.121.237.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:27:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:42:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2586, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.129.20.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:28:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:22:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6481, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.130.198.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:28:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:18:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5646, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.253.43.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:29:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:31:52Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 132" ], "sightings": 59035, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.161.122.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:29:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:41:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2262, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.48.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:29:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:36:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5915, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.107.253.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:30:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:43:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3231, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.61.2.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:31:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:29:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1588, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.34.14.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:18:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T20:00:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 20", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 263, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.125.95", "classifications": [], "first_seen": { "$date": "2023-01-27T19:29:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:29:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 486, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "221.156.126.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:32:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:27:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 132", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10297, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.63.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:39:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:16:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1721, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.22.233.252", "classifications": [], "first_seen": { "$date": "2023-01-27T19:34:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:34:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 242, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "1.249.45.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:49:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:02:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2568, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "97.81.247.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:49:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:56:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11775, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.218.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:50:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:02:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2569, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.181.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:50:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:57:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 100708, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.154.31.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:50:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:46:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4946, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.91.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:51:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:44:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 37", "ET SCAN Potential SSH Scan" ], "sightings": 12594, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "35.184.167.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:05:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2886, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "132.248.204.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T18:07:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 30" ], "sightings": 3135, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.140.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:53:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:10:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3205, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.145.16", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T19:56:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:56:13Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1284, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.9.19.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T19:57:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T19:58:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 642, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.222.49.151", "classifications": [], "first_seen": { "$date": "2023-01-27T19:59:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:00:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 20378, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "60.53.3.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:04:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:04:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 640, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.153.2.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:09:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:10:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1280, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.46.16.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T20:09:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:09:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1280, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.231.162.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:12:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:13:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 209424, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.201.203.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:12:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:12:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 38", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1056, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.241.10.161", "classifications": [], "first_seen": { "$date": "2023-01-27T20:22:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:22:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 638, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "83.229.115.152", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-27T20:22:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:16:37Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 10336, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "85.95.245.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T20:24:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:36:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19271, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "97.88.69.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:25:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:25:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 638, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.164.22.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:25:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 638, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.160.73", "classifications": [], "first_seen": { "$date": "2023-01-27T20:27:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:27:52Z" }, "ports": [ 4443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 319, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.94.138.103", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T20:28:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:19:35Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16150, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "135.125.233.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:30:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3801, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.149.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:30:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:04:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56" ], "sightings": 3175, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.181.15.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:18:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3487, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.250.65.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:31:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:46:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 6022, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.160.23.74", "classifications": [], "first_seen": { "$date": "2023-01-27T20:20:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:20:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 237, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.112.147.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:32:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:45:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2536, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "213.32.59.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:33:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:47:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3167, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.131.143.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T20:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:33:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 634, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.88.241.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:33:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:47:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2256, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.79.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:36:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:54:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2842, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "120.156.22.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T20:39:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:20:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10742, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.125.14.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T20:41:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:41:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 634, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.87.183.1", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-27T20:53:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T20:53:12Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1259, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "143.244.58.247", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T20:58:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:25:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2125442, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.197.6", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T20:58:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:31:19Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 14515, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "31.7.56.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:05:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:50:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.253.115.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:05:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:25:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 89", "ET 3CORESec Poor Reputation IP group 21" ], "sightings": 2540, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "51.77.147.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:06:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:19:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6241, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.63.196.4", "classifications": [], "first_seen": { "$date": "2023-01-27T21:06:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:08:48Z" }, "ports": [ 54720, 12964, 50698 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 939, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.252.79.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:06:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:34:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 158" ], "sightings": 2172, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.108.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:07:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:22:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2501, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.197.151.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:07:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:51:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9349, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.185.71.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:07:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:19:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2502, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "196.35.41.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:07:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:23:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2188, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.221.91.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:07:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:13:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9316, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.131.176.211", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T21:08:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:53:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 122918, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "77.22.0.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:08:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:09:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1252, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.200.159.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:09:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:39:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 35", "ET SCAN Potential SSH Scan" ], "sightings": 4661, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.173.255.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:10:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:04:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9328, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.22.216.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:10:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:24:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2500, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.129.177.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:13:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:13:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 626, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.18.47.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:13:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:13:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 626, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.134.133.66", "classifications": [], "first_seen": { "$date": "2023-01-27T21:14:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:15:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1170, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.66.208", "classifications": [], "first_seen": { "$date": "2023-01-27T21:18:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:18:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 27" ], "sightings": 234, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.39.85.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:18:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:13:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14667, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.93.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:18:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:20:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.61.197.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:24:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:24:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1872, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.194.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:24:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:37:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11486, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:24:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:36:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14741, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.194.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:28:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:02:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1970, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.163.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:29:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:29:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 624, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:30:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:48:18Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 30259, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.136.6", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T21:31:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:44:56Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 8010, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "190.144.14.170", "classifications": [], "first_seen": { "$date": "2023-01-27T21:18:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:21:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102", "ET 3CORESec Poor Reputation IP group 24" ], "sightings": 9498, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "114.204.218.154", "classifications": [], "first_seen": { "$date": "2023-01-27T21:19:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:19:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17" ], "sightings": 233, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.224.20.214", "classifications": [], "first_seen": { "$date": "2023-01-27T21:21:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:21:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 233, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "196.188.104.221", "classifications": [], "first_seen": { "$date": "2023-01-27T21:23:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:23:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 109", "ET 3CORESec Poor Reputation IP group 25" ], "sightings": 466, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "193.70.3.31", "classifications": [], "first_seen": { "$date": "2023-01-27T21:30:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:22:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 107" ], "sightings": 476, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.205.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:33:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:33:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 622, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.133.40.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T21:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:58:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3753, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.106.173.40", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-27T21:35:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T01:42:31Z" }, "ports": [ 0, 69 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP Get" ], "sightings": 18256, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "183.107.50.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:46:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:46:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 622, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.157.229", "classifications": [], "first_seen": { "$date": "2023-01-27T21:38:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:38:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 10", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 696, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "177.47.93.71", "classifications": [], "first_seen": { "$date": "2023-01-27T21:44:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:00:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1849, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.212.231.244", "classifications": [], "first_seen": { "$date": "2023-01-27T21:48:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:02:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1849, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.203.118.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T21:56:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:57:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 618, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.218.21.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:00:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:00:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 618, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.182.232.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:00:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:00:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 618, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:00:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:34:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34607, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.209.218.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:01:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 618, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.61.0.218", "classifications": [], "first_seen": { "$date": "2023-01-27T21:52:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:37:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 80" ], "sightings": 232, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.69.91.226", "classifications": [], "first_seen": { "$date": "2023-01-27T21:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:10:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 692, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.1.102.136", "classifications": [], "first_seen": { "$date": "2023-01-27T21:54:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T21:54:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 47" ], "sightings": 462, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.137.110.160", "classifications": [], "first_seen": { "$date": "2023-01-27T21:55:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:18:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 463, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "122.116.62.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:01:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:01:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 810, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.223.203.252", "classifications": [], "first_seen": { "$date": "2023-01-27T22:01:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:05:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 16862, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "83.229.115.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:02:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:02:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.56.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:07:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:07:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 616, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.188.182.153", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T22:15:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:20:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 53701, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "170.64.149.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:16:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:18:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 78" ], "sightings": 10219, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.59.87", "classifications": [], "first_seen": { "$date": "2023-01-27T22:07:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:07:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 230, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.241.230.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:18:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T19:20:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3314, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.244.61.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:19:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:40:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2751, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.217.164.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:20:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:51:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5654, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.168.122.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:20:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:48:12Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7183, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.149.20.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:21:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:37:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2752, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.138.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:21:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:53:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10001, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.15.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:21:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:49:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 148", "ET SCAN Potential SSH Scan" ], "sightings": 6745, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "137.184.21.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:22:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:35:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2751, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.191.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:23:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:46:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11043, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "207.154.223.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:24:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:35:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2445, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.154.61.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:26:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:26:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 612, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.79.65.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:29:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:43:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 166", "ET SCAN Potential SSH Scan" ], "sightings": 16114, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "159.223.70.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:31:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:09:56Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 60" ], "sightings": 7020, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.183.113.11", "classifications": [], "first_seen": { "$date": "2023-01-27T22:18:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:18:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 229, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "119.206.116.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:33:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:34:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15367, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:37:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:24:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 618, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.76.148.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T22:42:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:43:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 610, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.226.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T22:59:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T22:59:06Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 912, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.130.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:00:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:00:36Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 912, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "203.251.92.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:01:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T21:53:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 618, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.232.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:13:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:25:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5440, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.72.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:15:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:31:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3319, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.146.202.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:17:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:55:10Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 3" ], "sightings": 2754, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.240.28", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:21:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:05:31Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 930, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "69.49.230.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:22:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:36:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3010, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.149.200.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:26:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:36:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2514, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.177.169.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:27:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:27:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 602, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.137", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:30:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:10:50Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1757, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "46.174.53.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:32:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2404, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:31:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:40:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44593, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.104.247.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:22:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:13:24Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5127, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.79.143.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:36:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:40:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2306, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.19.191.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:36:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:49:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 97151, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.186.55.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:37:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:53:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1161, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.237.55.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-27T23:43:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:43:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 600, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.255.136.5", "classifications": [], "first_seen": { "$date": "2023-01-27T23:34:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:34:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 44", "ET 3CORESec Poor Reputation IP group 38" ], "sightings": 672, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "1.34.7.76", "classifications": [], "first_seen": { "$date": "2023-01-27T23:38:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:38:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 3", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 672, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "113.185.0.13", "classifications": [], "first_seen": { "$date": "2023-01-27T23:41:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:58:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1340, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.235.24.21", "classifications": [ "Misc activity", "Information Leak", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-27T23:47:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:57:24Z" }, "ports": [ 0, 53, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt", "SQL ping attempt" ], "sightings": 98816, "tags": [ "icmp", "udp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "14.36.178.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:48:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:48:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 598, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.106.219.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:52:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:52:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 598, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.79.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-27T23:57:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-27T23:59:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 598, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.177.182.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T00:00:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:00:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.79.143.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T00:02:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:02:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.39.65.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T00:09:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:41:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1114, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.72.230.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T00:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:14:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 596, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T00:14:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:32:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15477, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.111.82.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T00:16:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:25:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.167.207.234", "classifications": [], "first_seen": { "$date": "2023-01-28T00:08:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:08:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 444, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.240.32.119", "classifications": [], "first_seen": { "$date": "2023-01-28T00:11:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:11:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 222, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "212.192.246.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T00:20:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:29:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1180, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.199", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T00:41:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:43:43Z" }, "ports": [ 0, 161, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "X11 xdmcp info query" ], "sightings": 58224, "tags": [ "icmp", "udp", "snmp", "xdmcp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "184.105.139.77", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T00:46:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:44:32Z" }, "ports": [ 0, 1900, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "SQL ping attempt" ], "sightings": 24889, "tags": [ "icmp", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.33.75.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T00:46:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:47:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 592, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.139", "classifications": [ "Executable code was detected", "Misc activity", "Detection of a Network Scan", "Information Leak", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T00:47:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:23:54Z" }, "ports": [ 22, 0, 80, 1900, 161, 5632 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response" ], "sightings": 13265, "tags": [ "tcp", "ssh", "icmp", "alert", "http", "udp", "snmp" ], "rule_count": 11, "classification_count": 5 }, { "ioc": "20.198.123.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T00:43:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:48:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 116", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24806, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.216.141.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T00:47:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T00:48:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 590, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.205", "classifications": [ "Misc activity", "Decode of an RPC Query", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T00:50:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:51:53Z" }, "ports": [ 0, 111, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "X11 xdmcp info query" ], "sightings": 27556, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "xdmcp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "59.26.145.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T00:56:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:18:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1148, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.55", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T01:00:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:30:15Z" }, "ports": [ 22, 5632, 0, 1900, 161 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 17312, "tags": [ "alert", "tcp", "ssh", "udp", "icmp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "112.196.54.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:03:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:56:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7994, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "75.7.168.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:09:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:42:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 75" ], "sightings": 720, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "108.29.46.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:10:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:12:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 588, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T01:21:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:11:11Z" }, "ports": [ 0, 80 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 882, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.224.102.51", "classifications": [], "first_seen": { "$date": "2023-01-28T01:32:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:16:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1959, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "198.199.95.12", "classifications": [], "first_seen": { "$date": "2023-01-28T01:42:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:42:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 436, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "134.209.192.182", "classifications": [], "first_seen": { "$date": "2023-01-28T01:48:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:50:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 31", "ET SCAN Potential SSH Scan" ], "sightings": 10702, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "178.62.127.39", "classifications": [], "first_seen": { "$date": "2023-01-28T01:49:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:03:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 85", "ET SCAN Potential SSH Scan" ], "sightings": 25286, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.79.223.39", "classifications": [], "first_seen": { "$date": "2023-01-28T01:49:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:06:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1962, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "8.222.128.121", "classifications": [], "first_seen": { "$date": "2023-01-28T01:50:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:50:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 182" ], "sightings": 218, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.30.163.79", "classifications": [], "first_seen": { "$date": "2023-01-28T01:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:33:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 12778, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert", "anomaly" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "129.205.208.20", "classifications": [], "first_seen": { "$date": "2023-01-28T01:52:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:06:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 28" ], "sightings": 8023, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.82.1.138", "classifications": [], "first_seen": { "$date": "2023-01-28T01:52:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:05:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1526, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.228.180.55", "classifications": [], "first_seen": { "$date": "2023-01-28T01:52:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:52:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 436, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.249.87.201", "classifications": [], "first_seen": { "$date": "2023-01-28T01:53:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:49:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 115", "ET SCAN Potential SSH Scan" ], "sightings": 505, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "211.245.31.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:59:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:46:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5110, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.202.27.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:59:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:33:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18276, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert", "anomaly" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "43.138.50.80", "classifications": [], "first_seen": { "$date": "2023-01-28T02:10:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:13:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA STREAM TIMEWAIT ACK with wrong seq" ], "sightings": 109724, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 7, "classification_count": 0 }, { "ioc": "75.109.175.150", "classifications": [], "first_seen": { "$date": "2023-01-28T02:11:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:11:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 43" ], "sightings": 434, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.133.120.4", "classifications": [], "first_seen": { "$date": "2023-01-28T02:22:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:22:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 217, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "14.97.235.188", "classifications": [], "first_seen": { "$date": "2023-01-28T02:22:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:19:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6489, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "66.229.63.214", "classifications": [], "first_seen": { "$date": "2023-01-28T02:23:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:23:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 68" ], "sightings": 434, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.250.88.29", "classifications": [], "first_seen": { "$date": "2023-01-28T02:27:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:29:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 38", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 3467, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "200.122.249.203", "classifications": [], "first_seen": { "$date": "2023-01-28T02:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:43:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 112" ], "sightings": 8006, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.176.246.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:33:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:33:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 586, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.52", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T01:35:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:05:33Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1805, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "186.220.233.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:36:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:58:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9342, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.147.15.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:36:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:01:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1142, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.154.98.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T01:45:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T19:10:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2892, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.133", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-01-28T01:47:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:14:27Z" }, "ports": [ 0, 161, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt" ], "sightings": 87129, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "109.75.45.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:53:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T01:56:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1465, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "88.215.1.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T01:56:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:10:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2344, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.129.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:06:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:06:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 586, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.79.197.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T02:12:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:12:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 586, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.192.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:18:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:25:48Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 12270, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.202.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:32:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:37:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1129, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.235.88.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T02:33:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:33:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 586, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:33:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:44:34Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15666, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.68.68.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:33:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:20:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2336, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.8", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T02:36:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:29:24Z" }, "ports": [ 0, 1900, 161, 5632, 53, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response", "PROTOCOL-DNS named version attempt" ], "sightings": 34070, "tags": [ "icmp", "udp", "snmp", "ssh", "tcp", "ZGrab" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "14.46.182.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T02:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:44:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 586, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.109.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T02:45:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:31:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 31", "ET SCAN Potential SSH Scan" ], "sightings": 7605, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "114.33.20.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T02:45:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:46:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 586, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.186.48.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T02:46:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:51:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38458, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.119.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:47:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T11:55:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1933, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.118.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:49:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T02:49:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 584, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.24.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:49:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:27:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2328, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.24.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:51:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:23:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2324, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.227.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T02:59:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T07:27:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4192, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.27.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T03:02:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:02:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 584, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.82", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-28T03:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T20:34:28Z" }, "ports": [ 0, 69, 80, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "ET DROP Dshield Block Listed Source group 1", "SQL ping attempt" ], "sightings": 62338, "tags": [ "icmp", "udp", "tftp", "alert", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "162.243.142.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:11:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:58:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8254, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.75.116.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T03:11:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:12:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 584, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.98.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:19:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:50:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1974, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.234.17.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:26:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:21:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1617, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.94.3.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:26:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:26:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 584, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:29:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:51:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7660, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.192.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:30:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:48:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 588, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.153.165.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T03:33:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:53:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 592, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "70.166.21.147", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T03:37:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:36:11Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9680, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "198.199.97.57", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:26:21Z" }, "ports": [ 161, 0, 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 5375, "tags": [ "udp", "snmp", "icmp", "tcp", "snmptrap" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.219", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-28T03:47:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:11:47Z" }, "ports": [ 0, 80, 111 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 1835, "tags": [ "icmp", "alert", "tcp", "http", "udp", "sunrpc", "portmapper" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "107.170.245.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:47:59Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:43:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14755, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:56:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:29:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17021, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T03:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:57:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 582, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.69.161.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:03:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:21:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2619, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:03:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:41:15Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 11286, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.126.112.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:05:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:07:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.107.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:09:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:30:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1074, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:16:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:29:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11418, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.37.137.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:19:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:20:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.152.63.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:21:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:22:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.94.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:23:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:42:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.208.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:24:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:14:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4050, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.136.208.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:24:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:20:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 583, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.95.91.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:26:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:41:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2328, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.208.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:33:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:22:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:40:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:15:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9883, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.144.201.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:41:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:39:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8719, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:42:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:17:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41332, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.178.137.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:42:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:52:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41687, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.254.229.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:42:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:27:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3002, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.102", "classifications": [ "Detection of a Network Scan", "Misc activity", "Decode of an RPC Query", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T04:44:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:57:08Z" }, "ports": [ 1900, 0, 111, 177 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "X11 xdmcp info query" ], "sightings": 14450, "tags": [ "udp", "icmp", "sunrpc", "portmapper", "xdmcp" ], "rule_count": 5, "classification_count": 4 }, { "ioc": "65.49.20.90", "classifications": [ "Detection of a Network Scan", "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-28T04:46:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:46:51Z" }, "ports": [ 1900, 0, 69, 80 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "(stream_tcp) data on SYN packet" ], "sightings": 14210, "tags": [ "udp", "icmp", "tftp", "tcp", "http" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "141.22.28.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:46:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:12:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.6", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:47:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:52:45Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36138, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:48:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:11:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7372, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.3.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:49:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:50:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.237.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:50:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:50:31Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 873, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.217", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T04:55:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:15:02Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 15494, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.242.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T04:57:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:07:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9733, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.43.177.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:02:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:29:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23207, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:03:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:47:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.143", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T05:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:27:57Z" }, "ports": [ 0, 5632, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 43104, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "59.25.11.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:07:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.253.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:07:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:08:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11087, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:11:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:47:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1208, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.136.50.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:15:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:04:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23172, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.92", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T05:15:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:57:24Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 9418, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "209.141.51.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:17:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:45:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13921, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.144.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:18:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:43:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11333, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.201.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:18:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:30:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.61.18.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:18:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:19:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.75.151.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:19:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:55:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1648, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.241.110", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:26:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:52:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 100526, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.228.230.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:34:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:34:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.141.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:36:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:43:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4788, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.131.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:37:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:11:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.239.8.233", "classifications": [], "first_seen": { "$date": "2023-01-28T05:39:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:10:30Z" }, "ports": [ 4433, 3389, 10443, 8888, 8443, 8008 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1999, "tags": [ "tcp", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.147.235.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:43:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:18:17Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8525, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.71.151.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:46:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:46:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.99.110.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:47:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 670, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.170.200.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:47:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:49:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 580, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.250.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:53:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:30:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5280, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "73.59.224.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:53:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:54:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 580, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.46.152.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:54:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:40:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 7939, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.207.83.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:55:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:47:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46460, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.75.179.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:07:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2320, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.134.178.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:57:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:58:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 580, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.111.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T05:58:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:00:32Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 21913, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.197.146.75", "classifications": [], "first_seen": { "$date": "2023-01-28T06:00:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:24:32Z" }, "ports": [ 5439 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 726, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.170", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-28T06:00:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:04:27Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16321, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "220.88.129.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:05:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:07:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 580, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.44.25.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:09:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:09:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 580, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.55.0.8", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T06:09:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:33:11Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 31497, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "51.159.191.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:11:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:26:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2900, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.220.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T06:12:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:12:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.146.23.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:12:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:29:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2029, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.61.105.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:13:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:31:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2607, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.22.77.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:14:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:58:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8679, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.43.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:14:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:32:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is missing", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35624, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.24.81", "classifications": [], "first_seen": { "$date": "2023-01-28T06:17:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:17:24Z" }, "ports": [ 58603 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 290, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.63.107.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:20:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:20:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1160, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.70.190.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:27:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:06:22Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14474, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.133.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T06:29:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:29:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 578, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.98.9.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:31:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:32:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.208.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T06:32:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:14:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.152", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T06:38:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:27:07Z" }, "ports": [ 53, 0, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 9436, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "45.120.69.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:41:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:55:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2023, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "141.101.230.138", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T06:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:42:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1445, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.56.224.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:43:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:43:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8648, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.253.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:43:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:36:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8650, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.170.83.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:46:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:43:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8647, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.148.113.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:51:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:45:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8733, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.135.222.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:53:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:53:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 578, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.203.92.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T06:57:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:48:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1597, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.161.124.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T06:59:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:59:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 578, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.231.12", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T07:00:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:29:51Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 8618, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "183.101.106.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:01:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:23:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3640, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.144.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:05:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:37:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1517, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "177.74.191.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:13:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:13:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 288, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.42.41.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:13:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:13:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 576, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.136", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T07:18:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:15:27Z" }, "ports": [ 0, 53, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 53612, "tags": [ "icmp", "udp" ], "rule_count": 7, "classification_count": 4 }, { "ioc": "202.105.238.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T07:19:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:27:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12675, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "188.166.146.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:26:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:22:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7683, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.141", "classifications": [ "Attempted Information Leak", "Misc activity", "Executable code was detected", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T07:27:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:13:32Z" }, "ports": [ 53, 0, 80, 1434, 161, 5632, 22, 1900 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 37972, "tags": [ "udp", "icmp", "alert", "tcp", "http", "snmp", "ssh" ], "rule_count": 10, "classification_count": 4 }, { "ioc": "162.243.143.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T07:34:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:22:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1248, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.240.110.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:59:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 911, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.193.207.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:40:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:28:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3204, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.248.153.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:57:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2880, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.196.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T07:42:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:42:07Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 1374, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.142.192.6", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T07:42:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:28:46Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 16175, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "122.116.112.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:45:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:45:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 576, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.106", "classifications": [ "Misc activity", "Attempted Information Leak", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-28T07:46:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:55:43Z" }, "ports": [ 1434, 0, 177, 111, 80 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "PROTOCOL-RPC portmap listing UDP 111", "(stream_tcp) reset outside window" ], "sightings": 2804, "tags": [ "udp", "icmp", "xdmcp", "sunrpc", "portmapper", "tcp", "http" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "158.69.94.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:03:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2880, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.114.102.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:51:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:15:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1510, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.241.68.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:52:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:57:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14575, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.69.144.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:53:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:57:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8622, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.135.136.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:54:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:37:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1126, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.22.65.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:54:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:22:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4893, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.247.224.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T07:58:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:58:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 576, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.35.18.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T08:03:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:03:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.166.41.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:04:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:20:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3167, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.206.223.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:05:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:22:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2302, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.48.99.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:21:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2303, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.126.139.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:10:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:15:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1105, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.161.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:10:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:10:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 576, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.90.149.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T08:18:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:18:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.207.73.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:22:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:22:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 574, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.126.129.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T08:24:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:24:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 574, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.2", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-28T08:24:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:46:07Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 47469, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "124.156.180.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T08:26:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:26:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 574, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.116.159", "classifications": [], "first_seen": { "$date": "2023-01-28T08:27:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:17:18Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 2476, "tags": [ "icmp", "ssh", "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "180.0.217.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:30:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:31:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 574, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.51.73.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:31:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:31:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 574, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.191.78.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:48:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:49:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 574, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.214.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:50:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:50:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 574, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.229.13.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:50:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:13:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16865, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.150.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:54:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:26:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 164200, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.127.215.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:59:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:59:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 574, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.187.9.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:59:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:13:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2296, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.99", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-28T09:08:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:22:38Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4754, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "111.250.35.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T09:10:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:11:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 574, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.244.132.150", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T09:20:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:44:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 48002, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "185.159.129.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T09:28:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:44:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.196.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T09:28:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:30:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 572, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "150.129.151.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T09:35:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:37:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 572, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.83.49.141", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T09:39:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:42:47Z" }, "ports": [ 110, 2069, 162, 161, 2658 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 1430, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.73.158.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T09:41:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:46:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8552, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "213.87.101.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T09:41:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:09:58Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 129", "ET 3CORESec Poor Reputation IP group 29", "ET SCAN Potential SSH Scan" ], "sightings": 168193, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "189.45.78.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T09:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:06:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23248, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T09:44:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:22:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19962, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T09:47:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:10:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1081, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.175.101.108", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T09:56:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:52:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 171000, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.62.197.174", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T09:58:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:35:43Z" }, "ports": [ 0, 177, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 83305, "tags": [ "icmp", "udp", "xdmcp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "216.218.206.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T10:02:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:30:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3970, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.238.211.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T10:02:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:02:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.112.175.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:04:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:05:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 570, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.19.38.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T10:09:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:09:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.61.78.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:10:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:10:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 570, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "108.6.255.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:11:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:54:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 572, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T10:12:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:27:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25937, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.234.51.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:14:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:14:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 285, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.97.163.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:14:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:53:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18985, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.134.225.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:15:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:15:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 570, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.165.79", "classifications": [], "first_seen": { "$date": "2023-01-28T10:16:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:04:56Z" }, "ports": [ 8449, 8562, 7622, 7694, 7880, 8598 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1649, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.162.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:17:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:57:49Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32591, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "96.93.162.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:18:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:18:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 285, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.184.218.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:25:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2514, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.119.29.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:21:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:24:22Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 171" ], "sightings": 22799, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.166.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:22:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:23:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 570, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.153.171", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T10:28:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:00:49Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 33519, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "46.101.224.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:33:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:49:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3135, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.224.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:34:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:43:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1995, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.36.102.140", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-28T10:34:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:34:21Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1710, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "121.178.174.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T10:36:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:36:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "102.244.212.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:39:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:54:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1425, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.39.71.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T10:41:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:41:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.176.104.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:43:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:43:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 570, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.101", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T10:43:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:07:40Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 40074, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "182.16.179.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:49:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:50:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 932, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.33.220.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:51:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:06:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2280, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.182.181.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T10:53:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:12:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2565, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.83.201.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:06:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:18:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1090, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.56.113.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T11:08:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:08:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.133.225.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:09:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:15:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7580, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.229.176.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:10:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:11:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 570, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.136.50.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T11:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:12:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23355, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.248.219.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:23:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:11:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 60", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 578, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "167.248.133.142", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T11:24:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:56:53Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 33870, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "90.169.77.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:25:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:26:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 570, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T11:33:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:13:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.108.166.28", "classifications": [], "first_seen": { "$date": "2023-01-28T11:36:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:47:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 29771, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "198.199.108.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T11:40:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:20:37Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1325, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.153.5.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:44:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:59:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2840, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.177.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:46:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:58:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1988, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "120.232.250.170", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T11:51:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:13:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 59417, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "94.23.27.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:53:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:10:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 189", "ET SCAN Potential SSH Scan" ], "sightings": 2846, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "68.183.95.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:55:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:03:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2118, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.163.1.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:56:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:56:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4536, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.92.91.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:59:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:29:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69", "ET SCAN Potential SSH Scan" ], "sightings": 11515, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.153.194.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:01:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:28:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 149", "ET SCAN Potential SSH Scan" ], "sightings": 1803, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.59.18.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:01:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:42:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 4485, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.4.194.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:02:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:02:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 568, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.17.32.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:02:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:24:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6229, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.142.125.232", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-28T12:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:35:47Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32400, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "84.42.28.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:03:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:14:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2265, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.140.205.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:11:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:22:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1415, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.129.218.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:13:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:33:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1129, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.217.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:22:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 566, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.213.20.224", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T12:24:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:04:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 53390, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.178.244.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:34:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:34:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 566, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.219.142.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T12:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:09:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3674, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.89.144.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T12:44:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:44:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 566, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.78.76.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:46:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:48:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8487, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.235.196.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:46:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:47:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 566, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.179.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:48:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:48:07Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 159", "ET 3CORESec Poor Reputation IP group 36" ], "sightings": 15287, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "175.210.231.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:49:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:50:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 566, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.142.236.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T12:53:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:07:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18923, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.6.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T12:53:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:54:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 566, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.235.32.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T12:54:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:54:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 1132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.228.149.33", "classifications": [], "first_seen": { "$date": "2023-01-28T12:58:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:58:36Z" }, "ports": [ 875 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 283, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.189.31.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T13:03:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:10:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.226.204.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:22:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:22:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 283, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.248.133.150", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T13:23:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:23:20Z" }, "ports": [ 177, 0 ], "reporting_nodes": 1, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 849, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "149.106.153.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T13:25:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:25:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 566, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.43.50.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:41:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:41:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 849, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.128.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T13:43:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:12:05Z" }, "ports": [ 22, 0 ], "reporting_nodes": 3, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 512, "tags": [ "tcp", "ssh", "icmp", "alert", "anomaly" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "177.124.99.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:44:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:44:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.110.224.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:48:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:51:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4582, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.229.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:49:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:05:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1692, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.144.141.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:50:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:42:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8520, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.108.221.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:51:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:02:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2256, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.131.66.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:52:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:02:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1974, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.77.147.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:53:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:54:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1128, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.25.71.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:03:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:03:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.40.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:06:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:06:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.15.25.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:06:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:35:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8460, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.132.223.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:11:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:13:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T14:14:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:54:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7885, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.91.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:29:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:22:41Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 10", "ET SCAN Potential SSH Scan" ], "sightings": 33559, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "200.195.169.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:30:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:00:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15180, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "96.57.82.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:33:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:45:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 1692, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.122.131.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:43:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.221.54.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:48:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:48:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.108.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:57:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:58:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.84.234.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:58:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:28:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1101, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:04:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:07:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23937, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.156.76.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T15:10:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:15:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "(tcp) experimental TCP options found", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1693, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "126.203.34.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:12:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:12:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1128, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.149.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:15:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:15:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 564, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.118.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:15:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:19:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17574, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.238.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:17:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:31:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.103.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:19:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:12:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9155, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.129", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:21:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:10:41Z" }, "ports": [ 161, 0, 5632, 1434, 53 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "SQL ping attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 26343, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "192.241.203.6", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T15:21:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:32:40Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 638, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.209.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:23:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:59:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8457, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:25:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:10:33Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 577, "tags": [ "icmp", "ssh", "tcp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.231.146.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T15:26:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:53:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 585, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.245.16", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T15:37:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:01:28Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 1225, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "164.90.132.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:47:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:04:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13271, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.149.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:48:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:25:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1180, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.9", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:27:08Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2302, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "164.90.136.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:57:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:50:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13830, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.251.85.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T15:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:50:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 576, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.102.146", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T15:59:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:59:44Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18034, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "172.107.94.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T16:03:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:57:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T16:07:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:59:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1108, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.5", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T16:19:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:58:04Z" }, "ports": [ 1434, 0, 22, 80, 161, 53 ], "reporting_nodes": 3, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt" ], "sightings": 20921, "tags": [ "udp", "icmp", "alert", "tcp", "ssh", "ZGrab", "http", "snmp" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "191.54.249.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T16:28:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:28:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.207.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T16:31:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:52:50Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2746, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.249.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T16:34:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:34:12Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 846, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.129.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T16:57:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:57:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 562, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.172.190.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:01:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:18:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7842, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "108.60.219.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T17:02:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:02:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1405, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.70.56.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:04:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:10:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 113" ], "sightings": 165036, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.155.137.1", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T17:06:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:06:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.107.251.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:17:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:19:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 560, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T17:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:19:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.179", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T17:23:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:12:54Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 50103, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "143.198.237.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T17:27:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:27:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.198.24.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:28:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:28:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 560, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.109.207.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:29:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:27:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5058, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "136.228.161.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:30:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:43:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1680, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.39.227.143", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T17:35:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:55:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 75500, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "130.61.228.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:44:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:44:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 280, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.77.208.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:47:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:48:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 560, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.234.31.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:49:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:03:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1960, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.1.158.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:49:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:03:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2240, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.207.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T17:51:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:07:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2240, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.191.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T17:56:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:51:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 19073, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.142.160.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:01:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:01:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 560, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.229.189.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T18:05:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:05:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.215.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:07:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:58:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8376, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.186.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:09:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:09:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 280, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.104.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:12:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:23:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2516, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.116.53.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:18:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:19:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 559, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.161.52.41", "classifications": [], "first_seen": { "$date": "2023-01-28T18:29:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:29:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 279, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "109.195.194.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:04:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 773, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.200.47.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:36:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 558, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T18:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:29:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 568, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.52.105.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:36:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10694, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.69.125.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T18:53:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:54:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 558, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.207.246.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T19:10:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:55:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1103, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.94.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T19:13:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T19:13:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.223.18", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T19:16:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:01:42Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 2480, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "59.11.37.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T19:21:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T19:22:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 558, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.226.239.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T19:22:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:03:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 115" ], "sightings": 37296, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.186.207.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T19:23:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T19:23:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 558, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.21.161.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T19:24:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:38:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2609, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.81.32.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T19:41:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:39:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56675, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T19:45:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:50:58Z" }, "ports": [ 0, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 1355, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "159.89.181.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T19:47:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:10:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13813, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.176.176.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T19:58:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T19:58:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.143.25", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T19:59:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T19:59:12Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1116, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.205.242", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T20:03:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:50:51Z" }, "ports": [ 161, 0, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 14894, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "121.141.39.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:11:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:11:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 558, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.155.177.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:13:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:14:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 558, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.33.36.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:32:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:37:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2406, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.175.145.31", "classifications": [], "first_seen": { "$date": "2023-01-28T20:35:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:35:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 279, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.32.185.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:53:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 558, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.100.66", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T20:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:14:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 77674, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.248.22.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:48:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8340, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.250.79.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:58:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:13:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 4728, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.120.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:58:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:10:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2227, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.102.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:59:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:13:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2226, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.234.56.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:00:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:00:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.172.30.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T21:01:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:07:12Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 167", "ET SCAN Potential SSH Scan" ], "sightings": 15521, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "188.214.133.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:01:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:24:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1114, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.163.197.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T21:02:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:16:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1113, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.94.138.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:03:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:51:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 650, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.62.33.200", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:04:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:50:42Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 55534, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.235.24.171", "classifications": [ "Misc activity", "Detection of a Network Scan", "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T21:17:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:32:15Z" }, "ports": [ 0, 1900, 22, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 25" ], "sightings": 14851, "tags": [ "icmp", "udp", "tcp", "ssh", "alert", "http" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "212.239.216.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:19:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:19:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 556, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.197.88.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:30:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:22:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13811, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.74.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T21:30:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:31:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 556, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.218.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:39:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:39:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 556, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.117.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:42:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:48:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22519, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:42:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:35:24Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 9106, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "128.199.177.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T21:42:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:58:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2496, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.118.52.38", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic", "Detection of a Network Scan", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-28T21:42:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:01:56Z" }, "ports": [ 0, 1434, 161, 69, 1900, 111 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 29405, "tags": [ "icmp", "udp", "snmp", "tftp", "sunrpc", "portmapper" ], "rule_count": 10, "classification_count": 5 }, { "ioc": "111.32.152.252", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T21:43:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:05:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 78159, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "101.206.176.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:43:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:43:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 556, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.176.94.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T21:43:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:57:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 280, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.143.94.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T21:46:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:16:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1099, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.109.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:46:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:14:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2376, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.138.21.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T21:46:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:55:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5370, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.35.18.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:47:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:57:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2213, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.228.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:48:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:19:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:50:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:50:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.182.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:50:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:22:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13263, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.141.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:52:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:50:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2620, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.95.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T21:55:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:55:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.196.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:04:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:15:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16863, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:05:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:31:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1628, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.128", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:08:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:52:45Z" }, "ports": [ 65476, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1659, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "5.181.80.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:09:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:09:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.131.68.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:15:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:15:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:15:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:02:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1061, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:26:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:26:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.249.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:36:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:17:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15305, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.229.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:45:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:57:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9365, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.176.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T22:56:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:12:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2484, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.73.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T22:58:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:15:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 27" ], "sightings": 2552, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.208.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T22:58:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:11:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1099, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.38.55.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:18:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3312, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.147.94.138", "classifications": [], "first_seen": { "$date": "2023-01-28T23:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:51:55Z" }, "ports": [ 1203 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 552, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.93.16.238", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-01-28T23:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:55:18Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11121, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "119.69.121.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:25:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.222.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:26:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:42:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2208, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.252.87.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:26:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:35:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 944, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.182.231.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T23:29:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:29:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.93.191.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:32:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:59:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 319, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.91.101.179", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-28T23:33:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:33:20Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1656, "tags": [ "udp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "114.33.38.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:41:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:42:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.57.86.99", "classifications": [], "first_seen": { "$date": "2023-01-28T23:42:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:42:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "188.173.136.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:43:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:56:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2208, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.78.60.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:43:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:56:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2208, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.88.168.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T23:44:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:59:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2484, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.255.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T23:45:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:26:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1097, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.197.88.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T23:48:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:54:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.249.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-28T23:49:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:49:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.240.4", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T23:49:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:19:01Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 9718, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "222.109.92.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:00:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:01:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:11:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T07:59:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7720, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.117.130.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:15:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:16:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.130.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:26:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:26:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.91.107.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:28:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:29:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:32:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:11:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1588, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.79.145.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:32:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:32:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.208.20", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T00:33:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:55:38Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 1269, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.134.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:34:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:45:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.32.180.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:34:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:35:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.4.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:38:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:38:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.209", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T00:46:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:15:25Z" }, "ports": [ 0, 22, 177 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "X11 xdmcp info query" ], "sightings": 35312, "tags": [ "icmp", "alert", "tcp", "ssh", "Go", "udp", "xdmcp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "184.105.247.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:48:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:18:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2250, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.92.25.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:49:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:49:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.192.81.133", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T00:49:56Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:57:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 31589, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "113.187.150.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:53:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:53:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:55:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:02:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1754, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.133.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:55:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:28:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20824, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.233.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T00:57:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:26:03Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 2937, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.95.44.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:59:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:33:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6833, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.200.141.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T00:59:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:12:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1932, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.89.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:03:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:20:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1932, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.56.237.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:17:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1932, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.234.6.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:06:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:20:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2484, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.249.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T01:06:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:51:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19225, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T01:12:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:32:15Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4786, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "65.49.20.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T01:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:51:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.155.60.67", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T01:16:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:48:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 35846, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "222.114.241.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:20:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:50:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2412, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.32.203.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:21:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:39:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2208, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.87.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:22:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:37:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1932, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "132.255.169.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:23:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:43:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 30", "ET SCAN Potential SSH Scan" ], "sightings": 2832, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "177.12.6.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:28:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:28:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T01:31:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:51:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13602, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.58.172.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T01:36:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:36:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "156.155.240.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T01:45:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:45:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.114.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T01:55:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:05:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1208, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.138", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T02:01:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:48:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 30275, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "159.203.192.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T02:08:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:27:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.16.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:10:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:15:04Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 70" ], "sightings": 105211, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.64.139.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:10:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:28:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3025, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "80.11.127.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:11:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:27:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2750, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.116.103.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:14:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:14:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 550, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.92.22.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:15:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:25:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1650, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.140.215.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:18:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T17:03:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3274, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.245.26.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:18:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:30:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2942, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.122.221.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:18:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:36:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2750, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.110.139.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:19:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:57:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25204, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.153.80.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:20:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:25:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1100, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.246.130.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:20:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:57:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6584, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.68.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:20:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:35:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2200, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.176.52.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:21:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:55:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104910, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.191.82.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:22:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:24:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6898, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.254.37.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T02:24:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:38:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7465, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.165.25.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:26:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:42:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2200, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.35.197.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:26:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:03:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 1606, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "151.26.95.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:27:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:27:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 825, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.86", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-29T02:29:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:13:04Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6341, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "2.42.206.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:29:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:32:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2361, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.222.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T02:34:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:34:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 550, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.31.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:37:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 550, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.133.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:37:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:38:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 550, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.253.253.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T02:38:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:38:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 550, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.186.252.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:38:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:39:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 550, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "150.165.77.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:42:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:45:25Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14800, "tags": [ "tcp", "ssh", "OpenSSH_8.4p1" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.229.15.63", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T02:47:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:47:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3300, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.2", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-29T02:50:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:58:55Z" }, "ports": [ 0, 1434, 22, 53, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 61952, "tags": [ "icmp", "udp", "tcp", "ssh" ], "rule_count": 6, "classification_count": 4 }, { "ioc": "221.145.187.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:55:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:24:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 556, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.82.220.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T02:57:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:07:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 2064, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T02:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T08:06:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16307, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.41.75.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:07:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:21:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2129, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.155.162.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:42:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 152" ], "sightings": 2195, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.168.83.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:16:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T03:28:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2192, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.67.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:16:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:36:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 14261, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.166.145.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:17:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:11:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4370, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T03:19:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:26:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29419, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.232", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-29T03:23:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:23:55Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 1080, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "70.124.56.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:30:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T13:00:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3714, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.207", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T03:42:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:16:09Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22206, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.27", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-29T03:43:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:26:00Z" }, "ports": [ 53, 0, 1434, 161, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 43032, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "158.160.6.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:51:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:04:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 3276, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.168.21.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:01:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:01:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 546, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.203", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T04:03:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:32:50Z" }, "ports": [ 161, 0, 80 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 1868, "tags": [ "udp", "snmp", "icmp", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "144.217.13.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:05:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:12:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27538, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.141.50.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:07:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:22:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2457, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.151.51.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:07:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:19:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1092, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.248.219.190", "classifications": [], "first_seen": { "$date": "2023-01-29T04:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:08:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) partial start line" ], "sightings": 1092, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "93.43.240.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:09:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:09:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 273, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "150.109.172.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:09:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:24:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1911, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.27.140.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:23:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1911, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "81.12.39.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:11:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:25:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2184, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "60.50.230.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:13:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:13:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 546, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.56.134.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:13:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:31:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3549, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.119.215.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:35:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5750, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.84.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:20:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:38:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4641, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.229.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:20:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:35:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2184, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.142.125.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T04:20:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:09:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 47275, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.117.239.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:20:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:34:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8838, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "78.149.184.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T04:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:26:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.7.192.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:30:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:43:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2184, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.240.134.84", "classifications": [], "first_seen": { "$date": "2023-01-29T04:32:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:32:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 546, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "210.103.50.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:42:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:49:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20550, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.173.19.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T04:48:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:48:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.35.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T04:53:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:53:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.175.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:57:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:08:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 547, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.31.155.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T04:57:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:57:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 546, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.231.20", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T04:58:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:39:32Z" }, "ports": [ 162, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 281, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.139.98", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-29T04:58:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:22:20Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5734, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "66.240.192.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T05:03:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:03:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.163.9.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T05:03:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:23:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.207", "classifications": [], "first_seen": { "$date": "2023-01-29T05:08:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:08:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 273, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T05:10:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:49:57Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 13173, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "164.92.156.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T05:28:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:22:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 68" ], "sightings": 2900, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.225.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T05:29:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:29:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 546, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.196.170.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T05:32:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:55:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 759, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.96.51", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T05:32:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:32:37Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 819, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "139.59.11.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T05:32:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:32:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.110.250.168", "classifications": [], "first_seen": { "$date": "2023-01-29T05:33:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:33:11Z" }, "ports": [ 40000 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP distributed portscan" ], "sightings": 273, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.191.116.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T05:36:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:36:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 546, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.123.55.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T05:38:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:40:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 546, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.214.131", "classifications": [], "first_seen": { "$date": "2023-01-29T05:38:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:38:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 546, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.126.193.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T05:40:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:41:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 546, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.154.94.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T05:47:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:19:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4633, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.144.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T05:53:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19222, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.104.153.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T05:55:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:55:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:01:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:46:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8739, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "90.151.171.106", "classifications": [], "first_seen": { "$date": "2023-01-29T06:01:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:52:16Z" }, "ports": [ 1080, 3829, 9999, 7890, 8911, 3125, 80, 10001 ], "reporting_nodes": 3, "rules": [ "(port_scan) TCP portscan", "ET CINS Active Threat Intelligence Poor Reputation IP group 86" ], "sightings": 15210, "tags": [ "tcp", "alert", "http" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.225.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:03:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:03:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.96.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:05:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:19:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1068, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.117.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:05:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:05:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 545, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.211.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:06:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:03:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1376, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.98.96.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T06:09:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:14:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1056, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:11:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:04:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9690, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.24.177.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T06:12:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:58:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 33" ], "sightings": 967, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.175", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-29T06:16:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:53:10Z" }, "ports": [ 0, 80, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "PROTOCOL-TFTP Get" ], "sightings": 27279, "tags": [ "icmp", "tcp", "http", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "65.49.20.93", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-29T06:18:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:48:29Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 21158, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.223.25", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T06:20:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:27:02Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 546, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "34.23.185.255", "classifications": [], "first_seen": { "$date": "2023-01-29T06:24:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:59:27Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1346, "tags": [ "tcp", "ssh", "alert", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "220.134.51.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T06:24:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:25:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 544, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.8.52.73", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:29:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:29:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1360, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "61.81.177.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T06:30:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:08:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1546, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:35:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:53:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2083, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.94.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:44:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19780, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "102.23.122.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T06:55:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:07:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1360, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.152.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:55:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:30:35Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 36454, "tags": [ "icmp", "alert", "tcp", "ssh", "anomaly" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "134.209.200.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T06:56:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:16:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68282, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.129.174.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T06:56:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:56:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7869, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.64.215.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T06:57:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:12:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2448, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.93.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T06:58:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:05:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 556, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.96.85.142", "classifications": [], "first_seen": { "$date": "2023-01-29T07:02:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:02:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 272, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "209.214.105.154", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:02:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:03:17Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32918, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "209.127.214.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:03:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:03:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 544, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.66.59.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T07:08:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:08:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 544, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.116.3.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T07:09:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:26:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2448, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.193.148.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T07:11:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:25:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is missing" ], "sightings": 3264, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.164.92.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T07:15:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:15:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 544, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.160.101.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T07:17:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:53:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5125, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.117.185", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:19:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:19:07Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 816, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.253.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:20:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:46:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.110.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:30:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:16:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.146.173.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T07:31:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:54:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8041, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.248.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:34:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:34:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 542, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.19.218.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T07:40:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:40:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 542, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.201.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:42:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:42:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 542, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.71", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-29T07:46:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:53:12Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 6027, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.198.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:54:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:05:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3242, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.94.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T07:59:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:52:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 548, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.32", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T08:02:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:03:20Z" }, "ports": [ 0, 162 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 1080, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "212.83.172.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:08:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:12:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1016, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.26.178.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:11:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:25:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 548, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.96.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:43:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1065, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.167.66.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:21:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:21:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 540, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.2.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:21:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:23:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.205.213.22", "classifications": [], "first_seen": { "$date": "2023-01-29T08:21:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:56:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 1616, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.117.58.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:29:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:30:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.208.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:34:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:42:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:36:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T10:26:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10913, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.206", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T08:36:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:06:17Z" }, "ports": [ 0, 80, 177 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "X11 xdmcp info query" ], "sightings": 25272, "tags": [ "icmp", "alert", "tcp", "http", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.229.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:38:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:23:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2032, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.9.149.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:03:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2135, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.96.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:28:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1066, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.135.43.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:40:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:58:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3707, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.113.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:58:17Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 15385, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.102.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:49:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:32:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12960, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.198", "classifications": [ "Misc activity", "Decode of an RPC Query", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-29T08:49:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:53:56Z" }, "ports": [ 0, 111, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-TFTP Get" ], "sightings": 44158, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "tftp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "45.55.0.11", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T08:49:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:48:18Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 3628, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "118.219.54.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:52:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T04:54:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 20" ], "sightings": 2214, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.189.51.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:52:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:07:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2160, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.253.175.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:53:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:26:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14264, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.154.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:54:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:09:36Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 33", "ET SCAN Potential SSH Scan" ], "sightings": 39025, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "165.154.243.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:54:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:40:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14256, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.21.52.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:55:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:10:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2430, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.102.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:55:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:27:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7194, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.212.208.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:56:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:08:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 3240, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.228.252.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T08:57:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:02:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1070, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "90.17.192.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:59:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:59:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.194.94.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T09:01:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:02:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.45.28.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T09:04:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:05:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.218.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:15:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:05:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 544, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:16:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:43:08Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack" ], "sightings": 551, "tags": [ "icmp", "alert", "tcp", "http" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "220.132.86.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T09:17:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:17:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.131", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-29T09:17:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:37:31Z" }, "ports": [ 0, 177, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get" ], "sightings": 35674, "tags": [ "icmp", "udp", "xdmcp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "192.241.227.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:43:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14338, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.107.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:26:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:23:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 544, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.206.100", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:26:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:55:31Z" }, "ports": [ 161, 0, 1434 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 11401, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.146.35.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T09:28:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:28:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.192.7", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:28:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:28:57Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 810, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "65.49.20.117", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-29T09:30:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:36:14Z" }, "ports": [ 0, 80, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 10303, "tags": [ "icmp", "tcp", "http", "udp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "65.49.20.73", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-29T09:34:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:38:17Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 21329, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "181.48.125.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T09:35:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:36:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.240.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:37:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:38:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24777, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.147.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:43:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:59:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5216, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.128", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T09:49:25Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:43:07Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 35434, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "81.0.218.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:51:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:29:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1054, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.151.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:55:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T23:54:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.141.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T09:56:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:59:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8653, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.197", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T09:57:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:54:41Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 31094, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.203.230.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T09:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:37:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5184, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.219.167.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T10:01:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:17:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2430, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.255.115.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T10:05:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:14:16Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 133", "ET 3CORESec Poor Reputation IP group 32" ], "sightings": 6505, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "104.131.144.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T10:09:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:33:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15748, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.224.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T10:23:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:31:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7218, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.100.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T10:25:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:29:07Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 10550, "tags": [ "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "58.246.96.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T10:28:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:30:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 810, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.4.210.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T10:29:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:30:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 540, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T10:33:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:33:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 539, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.97.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T10:37:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:09:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2562, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.136.170.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T10:43:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:44:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.200.255.209", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T10:44:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:44:39Z" }, "ports": [ 2104, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 538, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T10:51:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T10:20:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.185.172.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:07:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:07:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.219.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T11:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:56:14Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1330, "tags": [ "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.250.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T11:11:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:46:47Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 5001, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.240.51.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:21:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:31:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2421, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.1.34.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T11:24:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:24:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1345, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "194.195.122.95", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T11:25:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:03:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 176989, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "219.145.166.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:26:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:26:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.26.45.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:28:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:29:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "96.243.32.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:30:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:31:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.55.231.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:27:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9106, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.18.147.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:35:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:56:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 539, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.227.175.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:44:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:09:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1340, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.59.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:46:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:37:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 39", "ET SCAN Potential SSH Scan" ], "sightings": 4892, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "159.223.120.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:46:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:50:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8553, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.143.142.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:47:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:47:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 269, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.195.230.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:47:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:48:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.122.74.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:47:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:00:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2421, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.227.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T11:52:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:33:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 542, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.159.199.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T11:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:29:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3033, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.200.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T11:54:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:54:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "131.72.175.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:04:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:22:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2152, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.36.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T12:06:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:06:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.29.102.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:06:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:17:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2152, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.55.133.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:11:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:12:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.88.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:15:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:16:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.166.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:16:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:16:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.0.236.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:19:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:19:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.104.209.246", "classifications": [], "first_seen": { "$date": "2023-01-29T12:21:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:21:19Z" }, "ports": [ 41759 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 269, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.159.207.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:35:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:28:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 541, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.79.223.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:35:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:59:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 3561, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.34.234.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:41:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:41:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.240.182.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:43:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:43:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "90.50.159.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:49:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:50:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.167.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T12:52:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:52:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.89.77.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:53:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:10:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1883, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.163.145.40", "classifications": [], "first_seen": { "$date": "2023-01-29T12:53:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:48:46Z" }, "ports": [ 34511, 54367 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 4766, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "221.157.169.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:55:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:34:26Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8044, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.114.245.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:01:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:15:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 564, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.10.12.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:18:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:19:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.6.151.194", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-29T13:22:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:08:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 62748, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "218.161.62.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:23:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:23:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 538, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.146.4.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:34:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:35:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 536, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.164.37", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T13:39:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:46:04Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 1326, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "18.144.31.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T13:41:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:41:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 536, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.95.124.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:44:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:04:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37950, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.22.4.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:45:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:54:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1606, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.109.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:45:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:49:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3046, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.105.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:45:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:36:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 58" ], "sightings": 2675, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.82.241.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:46:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:00:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1604, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.164.81.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:47:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:52:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8012, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.229.134.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T13:47:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:20:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8042, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.10.144", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-01-29T13:52:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:52:18Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1602, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "34.227.225.236", "classifications": [], "first_seen": { "$date": "2023-01-29T14:00:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:08:29Z" }, "ports": [ 80, 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 524, "tags": [ "tcp", "http", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.25.213.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:05:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:06:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 534, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.118.253.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:05:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:06:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 534, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.222.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:06:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:07:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 534, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.68.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:09:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:56:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 535, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.9.118.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:11:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:14:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 104", "ET 3CORESec Poor Reputation IP group 24" ], "sightings": 22850, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "104.248.120.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:12:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:23:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2136, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.0.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:13:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:19:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17642, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.50.229.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:13:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:14:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8010, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.123.190.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T14:16:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:16:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T14:26:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:26:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.110.81.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:29:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:51:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1037, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.144.19", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T14:40:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:54:35Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 9523, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "117.55.148.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T14:44:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:44:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.14.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:46:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:46:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 534, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.75.24.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:48:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:49:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 534, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.158.25.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T14:49:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:50:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 534, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.232.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T15:04:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:04:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 534, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.255.124.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T15:14:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:14:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.178.190.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T15:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:33:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1068, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.94.93.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T15:45:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:33:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2017, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "105.225.13.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T15:46:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:48:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1602, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "70.26.77.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T15:47:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:47:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.253.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T16:09:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:09:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.133.203.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T16:09:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:51:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37477, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.68.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T16:12:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:02:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7980, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "80.28.234.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T16:13:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:35:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1330, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "144.22.147.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T16:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:23:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1064, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.222.58.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T16:15:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:30:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1063, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.150.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T16:40:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:05:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1956, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T16:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:15:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3566, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.235.139.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T16:52:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:55:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1012, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.89.127.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:01:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:01:01Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10197, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.25", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-29T17:13:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:28:59Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 538, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "211.114.214.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:15:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:17:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.13.69.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:16:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:16:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T17:19:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:57:59Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8408, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "183.103.215.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:26:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:26:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.229.158.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:47:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:47:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.50.175.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:47:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:48:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.129.179.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:53:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T18:08:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2394, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.253.164.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:54:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:52:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9725, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.250.79.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:55:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:15:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 5327, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.194.110", "classifications": [], "first_seen": { "$date": "2023-01-29T17:58:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:19:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 1530, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.200.21.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:58:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:25:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9144, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.138.91.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T18:07:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:18:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 921, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.80.22.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T18:15:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:49:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 269, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.255.227.73", "classifications": [], "first_seen": { "$date": "2023-01-29T18:27:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T18:27:24Z" }, "ports": [ 17324 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 266, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.142.125.229", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-29T18:39:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:13:08Z" }, "ports": [ 69, 0, 111 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 1091, "tags": [ "udp", "tftp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "192.241.231.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T18:50:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:23:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1041, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.97.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T18:52:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:14:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8110, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.150.240.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T18:52:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:38:18Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5953, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.48.124.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T18:53:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:38:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6365, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T18:58:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T18:58:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.227.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T19:02:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:06:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13088, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T19:03:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:43:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.222.216.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:05:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:20:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2394, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.117.63.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:08:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:09:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.43.149.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:08:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:25:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1330, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.230.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T19:12:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:24:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10345, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.177.76.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:18:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:19:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.146.217.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:23:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:23:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 266, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.231.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T19:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:38:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18749, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.120.121.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:24:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:07:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6415, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.139.58.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:25:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:28:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7965, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.127.44.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:37:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:37:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.116.180.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:41:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:43:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.128.179.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T19:51:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:51:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.231.8.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:19:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:19:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 530, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.8.252.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:20:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 530, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.213.214.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:21:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:00:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1006, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.76.57.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T20:25:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:25:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 530, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.126.112.35", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T20:30:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:49:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 88248, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "222.101.75.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:31:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:51:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5642, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.252.170.53", "classifications": [], "first_seen": { "$date": "2023-01-29T20:36:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:36:04Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 792, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.45.116.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:41:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:42:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 8" ], "sightings": 531, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.18.58.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T20:46:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:46:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.201.188.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:53:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:53:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 264, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.218.23.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:53:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:42:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3180, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.95.235.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:55:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:08:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2376, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.186.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:58:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:16:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7938, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.82.117.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:58:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:00:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 93079, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.147.4.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T20:58:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:22:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1320, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.221.17.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:00:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:14:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1848, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.168.205.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:01:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:02:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.194.150.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:05:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:07:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream after TCP reset sent" ], "sightings": 792, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "125.229.48.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:09:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:49:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1048, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "1.168.61.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:11:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:11:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.164.156.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:23:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:24:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.177.212.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:29:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:48:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.225.117.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:32:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:33:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.51.208.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:45:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:02:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1848, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.101.104.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:52:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T21:54:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:54:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.84.239.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:54:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:55:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "108.213.65.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:55:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:55:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.110.32.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T22:04:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:04:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.50.144.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T22:09:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:09:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.108.73.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T22:11:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:12:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 528, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.74.120.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T22:15:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:15:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.17", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T22:30:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:37:12Z" }, "ports": [ 0, 161, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 30481, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "104.244.227.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T22:41:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:41:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.220.228.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T22:53:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:53:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1320, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "47.99.70.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T22:54:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:54:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "132.226.30.190", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T22:59:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:59:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.131.27.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T23:14:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:14:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.43.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:23:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:38:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2367, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.140.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:24:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:42:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2630, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.14.209.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:26:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:36:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1841, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.44.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:15:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "ET SCAN Potential SSH Scan" ], "sightings": 15899, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "195.154.185.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:24:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6293, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.174.197.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:32:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:46:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1841, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.207.98.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:34:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:47:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2630, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.105.112.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:40:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:25:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 741, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.207.232.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:43:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1855, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.227.49.23", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-29T23:44:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:22:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 70903, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "165.154.236.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:45:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:21:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3623, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.205.104.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:46:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:52:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187" ], "sightings": 10673, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T23:46:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:46:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 526, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.161.157.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:46:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:02:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2893, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "24.199.104.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:04:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2630, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.72.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:05:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2104, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.222.116.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:47:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:41:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 164" ], "sightings": 4133, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.254.0.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:48:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:08:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2376, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.193.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:49:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:50:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8483, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "197.248.2.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:49:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:02:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1841, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "168.138.156.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:49:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:01:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1841, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.185.141.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:54:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:10:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1838, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.141.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:54:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:56:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 95778, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "74.102.242.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:55:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:56:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 526, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.73.133.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:56:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:07:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2103, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.56.181.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:56:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:08:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1313, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.2.190.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:56:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:56:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 526, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.204.170.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:57:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:05:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7074, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.67.217.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T23:58:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:30:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2116, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "207.46.229.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:02:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:12:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 787, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.94.193.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:04:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:27:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 171" ], "sightings": 2114, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.208.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:04:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:19:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2097, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "145.255.5.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:04:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:21:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2359, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.144.116.81", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T00:09:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:22:34Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2000, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.126.128.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:09:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:10:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 524, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T00:12:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:27:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.168.235", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-01-30T00:12:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:34:15Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1572, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.71.198.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:13:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:30:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2358, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.186.218.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:14:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:15:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 524, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.9.27.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T00:18:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:30:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3885, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "110.145.118.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:19:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:20:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 524, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.114.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:19:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:17:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 999, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.20", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-30T00:23:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:24:58Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 3852, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.61", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-30T00:29:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:39:35Z" }, "ports": [ 0, 161, 80, 1900 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 62776, "tags": [ "icmp", "udp", "snmp", "alert", "tcp", "http" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "74.83.210.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T00:41:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:42:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 524, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.240", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T01:05:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:30:14Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 2665, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "202.141.255.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T01:07:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:07:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 524, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T01:08:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:25:56Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19077, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "82.196.5.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T01:09:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:24:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2355, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.137.98.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T01:10:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:11:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1572, "tags": [ "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.207.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T01:18:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:09:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1336, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.98.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T01:24:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:55:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 540, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.149", "classifications": [ "Misc activity", "Executable code was detected", "Information Leak", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T01:33:16Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:25:13Z" }, "ports": [ 0, 22, 1434, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-DNS named version attempt" ], "sightings": 53484, "tags": [ "icmp", "tcp", "ssh", "udp" ], "rule_count": 8, "classification_count": 4 }, { "ioc": "118.42.22.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T01:35:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:36:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 522, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.201.206.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T01:39:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:34:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3438, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.216.18.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T01:39:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:39:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 522, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.143.81.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T01:40:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:41:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 522, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.216", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T02:00:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:21:09Z" }, "ports": [ 0, 1434, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "X11 xdmcp info query" ], "sightings": 1462, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "61.85.90.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:00:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:02:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 522, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.49", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T02:02:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:20:04Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 7085, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.205.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T02:04:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:33:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42113, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T02:04:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:26:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17330, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.165.116.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T02:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:04:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1031, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.167.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:06:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6656, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.75.19.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:06:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:40:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 128" ], "sightings": 5051, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.231", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-01-30T02:06:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:12:09Z" }, "ports": [ 0, 80, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window", "PROTOCOL-TFTP Get" ], "sightings": 17146, "tags": [ "icmp", "tcp", "http", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.40.81.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:07:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:47:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 73254, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.124.198.34", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-30T02:12:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:12:19Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 783, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.243.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T02:12:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:58:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.14.86", "classifications": [], "first_seen": { "$date": "2023-01-30T02:26:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:26:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 522, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "216.218.206.77", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T02:32:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:41:32Z" }, "ports": [ 0, 161, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "X11 xdmcp info query" ], "sightings": 11844, "tags": [ "icmp", "udp", "snmp", "xdmcp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "152.70.254.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:17:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2861, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.14.87.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:37:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:38:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 522, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.82.100.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:50:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2602, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.255.240.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:39:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 522, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.171", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T02:40:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:11:45Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 24994, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.153.12.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:40:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:53:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1821, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.206.179.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:43:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:43:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.91.166.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:43:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:56:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5980, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T02:56:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:29:22Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 11811, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.126.39.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:59:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:00:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.83.144.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:01:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:51:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "(stream_tcp) TCP timestamp is outside of PAWS window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1300, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.130.62.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:03:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:19:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2340, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.64.211.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:08:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:10:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.81.77.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:15:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:20:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 780, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "15.181.162.230", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T03:15:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6121, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "95.250.173.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:18:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.237.212", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T03:18:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6239, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "111.125.109.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T03:34:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:34:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 520, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.97.212.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:38:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:53:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1300, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.96.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:53:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T02:15:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 28", "ET SCAN Potential SSH Scan" ], "sightings": 3003, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.59.213.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:56:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:09:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2340, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.166.251.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:04:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:16:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1754, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.236", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T04:06:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:09:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 8776, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.148", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T04:08:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T07:42:50Z" }, "ports": [ 1434, 0, 1900, 161 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 20541, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "198.199.105.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T04:13:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:36:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15636, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.94.4.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T04:14:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:14:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 520, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.159.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:14:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:15:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.26.55.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:22:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:22:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.110.8.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:32:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:43:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1560, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.139.247.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:32:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:33:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.218.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T04:32:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:48:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.28", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T04:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:35:25Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 780, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.109.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T04:38:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:38:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 520, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.70.152.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:44:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.135.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T04:44:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:48:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2652, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.84.88.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:44:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:45:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 520, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.116.228.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:52:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:07:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2073, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.204.31.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:54:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:13:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2332, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.247.137.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:54:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:37:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7767, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.223.60.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:56:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:09:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 118" ], "sightings": 7693, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.147.159.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:00:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:23:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 518, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T05:02:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:09:14Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 4542, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "213.55.93.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:05:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6439, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "141.94.175.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:06:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:19:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2072, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.101.85.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:07:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:51:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7757, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.101.110.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T14:07:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 159", "ET 3CORESec Poor Reputation IP group 36" ], "sightings": 21908, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "41.210.23.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:08:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 7982, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.26.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:17:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:32:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2590, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "72.167.55.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:17:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:33:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2849, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.97.151.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:18:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:33:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2590, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.236.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:19:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:20:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7718, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.64.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:19:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:19:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7721, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.211.117.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:19:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:19:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 518, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.140.95.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:20:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:20:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 259, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "31.179.162.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:21:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:56:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14277, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.163.153.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:22:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:16:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7720, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.140.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T05:33:25Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:49:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.63.213.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:43:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 259, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.232.48.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:44:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:43:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum" ], "sightings": 262, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.74.114.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:45:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:59:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2320, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.159.226.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:46:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:46:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 258, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.147.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:46:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:02:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2061, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.78", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-30T05:46:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:26:35Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 10931, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "173.186.116.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:46:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:01:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2061, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "140.238.177.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:47:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:19:02Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 40" ], "sightings": 252653, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.236.101.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:47:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:34:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 79480, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.72.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:53:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:10:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2314, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.193.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T05:54:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:46:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5012, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.30.119.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:56:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:22:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15102, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.72.128.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:56:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:56:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 257, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.192.122.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T06:06:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 55549, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.30", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-30T06:09:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:55:06Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 66380, "tags": [ "udp", "icmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "59.126.92.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T06:15:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:15:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 514, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T06:18:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:18:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 514, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.88", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-30T06:18:55Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T03:55:45Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 4548, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T06:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:03:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38422, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.47.246.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T06:23:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:24:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 514, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.141", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T06:35:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:53:07Z" }, "ports": [ 0, 161, 22, 53, 1434 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "SQL ping attempt" ], "sightings": 75500, "tags": [ "icmp", "udp", "snmp", "tcp", "ssh", "ZGrab" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "45.79.141.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T06:39:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:30:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 990, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.105.193.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T06:39:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:02:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 125" ], "sightings": 1287, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.187", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T06:40:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:50:59Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 37014, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "178.124.175.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T06:42:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:42:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1285, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "112.30.163.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T06:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:29:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream after TCP reset received" ], "sightings": 919, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T06:46:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:54:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36461, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "4.196.185.249", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:00:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 9914, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "164.92.242.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:03:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:16:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.14.232.148", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T07:04:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:04:50Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 256, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.224.19.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:05:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:06:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 512, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.97.175.100", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T07:13:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:13:41Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 256, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.144.174.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:13:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:26:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 987, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.116.41.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:14:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:14:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.46.255.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:20:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:42:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1024, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.65.52.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:28:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:36:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 513, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.194.251.46", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:31:04Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1536, "tags": [ "udp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "54.146.108.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:32:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:32:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 256, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.34.199.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:33:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:33:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 512, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.231.72.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:34:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:34:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 512, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.81.4.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:36:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:06:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 123", "ET 3CORESec Poor Reputation IP group 27" ], "sightings": 2936, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.203.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:38:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:45:38Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6114, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.68.208.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:39:44Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 768, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "195.133.40.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:47:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1024, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T07:56:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:36:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1328, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.189.11.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:01:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:58:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7527, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.59.120.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:06:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:24:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2560, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.132.215.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:09:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:39:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1686, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.111.159", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-30T08:10:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:15:12Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1531, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.225.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T08:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:14:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.175.69.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:20:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:20:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 512, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.69", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-01-30T08:26:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:18:04Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 9007, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "109.74.193.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T08:29:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:07:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1024, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.18.1.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T08:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:30:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.41.245.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:35:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:35:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 512, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.96.214.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:36:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:52:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1536, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.250.14", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T08:37:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:14:41Z" }, "ports": [ 162, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 766, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "1.164.82.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:45:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:46:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 512, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.17.57.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T08:46:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:46:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1024, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.215.203.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:52:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:53:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 512, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.90.213.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:00:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:16:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.53.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:01:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:13:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.30.241.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T09:07:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:07:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.152.57.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:12:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:09:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5927, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.21.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:14:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:25:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.222.12.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:18:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:38:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30227, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.201.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T09:19:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:19:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.96.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T09:27:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:23:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1022, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.118.147.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:31:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:42:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1533, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.163.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T09:34:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:34:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.128.18", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T09:37:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:02:01Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 31450, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.210.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T09:46:12Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:24:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7268, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.199", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T09:48:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:49:35Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4722, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.207.136.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:50:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:51:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1020, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.236", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-01-30T09:53:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:58:53Z" }, "ports": [ 1900, 0, 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 10491, "tags": [ "udp", "icmp", "alert", "tcp", "ssh" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.142.125.128", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T09:56:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:08:35Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 31527, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.252.73.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:00:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:00:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 510, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.97.212.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:09:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:09:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 510, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.245.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:15:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:19:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18866, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.242.57.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:16:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:18:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1020, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.227.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:18:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:24:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 514, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.139.198.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:02:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29217, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.180.123.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:24:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:43:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 125367, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.208.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:24:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:39:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1530, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.2.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:25:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1650, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.191.189.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:26:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:26:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 510, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.226.5", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:26:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:51:20Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3666, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "123.30.187.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:27:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:43:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1557, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.240.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:28:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:42:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1530, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.193.72.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:29:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:29:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.55.0.5", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:31:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:31:47Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1020, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.197.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:36:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:29:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.102.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:39:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:21:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.10.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:43:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:06:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1017, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:45:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:49:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 518, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.247.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:46:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:46:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.114.232.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:48:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:48:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.116.89.251", "classifications": [], "first_seen": { "$date": "2023-01-30T10:53:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:18:45Z" }, "ports": [ 23026, 11898, 41671, 13694, 27579 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP has no SYN, ACK, or RST", "(tcp) XMAS attack detected", "(tcp) TCP SYN with RST", "(tcp) TCP SYN with FIN" ], "sightings": 46663, "tags": [ "tcp" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "8.219.220.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:54:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:54:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 255, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.226.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:55:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:50:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9396, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.92.127", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T10:55:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:47:36Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2841, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "12.191.116.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:57:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:11:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2295, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.109.174", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T11:06:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:58:29Z" }, "ports": [ 0, 162, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 20430, "tags": [ "icmp", "tcp", "snmptrap", "alert", "ssh", "anomaly" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "192.241.239.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:08:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:53:59Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 18035, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "174.135.154.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:11:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:13:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 510, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.169.176.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:20:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:32:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 282, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.250.111.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:20:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:42:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.76.62.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:20:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:31:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1275, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.80.228.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:21:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:35:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2295, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.192.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:22:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:38:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2550, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.14.80.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:24:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:24:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.238.186.72", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T11:29:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:30:46Z" }, "ports": [ 3389, 161, 9901 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 765, "tags": [ "tcp", "rdp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.241.89.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:31:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:31:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 510, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.166.140.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:32:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:32:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 510, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.144.168.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:32:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:32:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:33:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:11:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:34:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:34:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "98.192.188.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:36:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:36:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 510, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.6.130.144", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:38:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:54:07Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 777, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "222.252.243.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:40:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:53:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10370, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.59.125.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:40:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:52:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1525, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.224.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:41:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:37:36Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3076, "tags": [ "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "144.126.209.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:22:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7608, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.200.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:40:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3188, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.240.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:43:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:11:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10601, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.242.87.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:43:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:52:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11157, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.214.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:48:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:54:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16733, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.151.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:48:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:07:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 522, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.153.190.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:49:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:44:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7540, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.34.228.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:49:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:50:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 508, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.206.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T11:50:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:39:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5808, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.37.120.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:50:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:24:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1014, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.245.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:00:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:00:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 508, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.150.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:02:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:02:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 508, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.106.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:03:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:04:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 508, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.91.254.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:05:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:40:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6486, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.188.166.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:53:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7590, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.93.186.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:09:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:27:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1771, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "219.127.11.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:15:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:25:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 131", "ET SCAN Potential SSH Scan" ], "sightings": 2093, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.240.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:16:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:16:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 506, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.217.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:22:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:21:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17668, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.43.62.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:25:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:39:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 980, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.157.51.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:27:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:27:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 506, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:28:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T01:30:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4744, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.40.57.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:30:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:30:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 506, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.48.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:31:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:31:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 506, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.205.21", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T12:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:20:39Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 14004, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "14.198.125.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:36:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 506, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.194.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T12:37:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:52:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10665, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.136.127.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:38:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:22:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 518, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "220.133.122.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:28:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 30" ], "sightings": 1730, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "125.228.11.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:52:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:52:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 506, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "73.12.60.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:53:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:53:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 506, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.11.235.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:01:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:01:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 506, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.233.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:06:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:47:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25829, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.211.65.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:08:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:08:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 506, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.245.92.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:16:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:53:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1464, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.187.183.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:33:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 980, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.5.159.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:18:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:31:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2016, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.97.160.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:18:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:16:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7260, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "208.109.12.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:18:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:37:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15886, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.79.221.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:18:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:47:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3497, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.222.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:19:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:16:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10615, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.225.126.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:19:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1762, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.55.63.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:19:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:13:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3130, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.111.23.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:19:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1512, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.93.136.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:19:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:32:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 2268, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.119.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:20:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:31:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2016, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "116.193.190.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:21:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:23:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7497, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.6.12.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:22:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:47:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4114, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.215.49.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:22:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:22:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 504, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.231.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:23:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:25:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31958, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.194.39.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:24:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1244, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "213.45.51.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:25:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:25:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 504, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.117.42.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:26:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:24:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1003, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "52.227.167.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:26:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:43:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 83036, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.234.80.18", "classifications": [], "first_seen": { "$date": "2023-01-30T13:27:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:01:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 979, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "121.131.182.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:29:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:29:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 504, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.209.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:29:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:29:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 504, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.94.40.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:31:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:31:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1008, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.128.21", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T13:32:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:18:20Z" }, "ports": [ 0, 22, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload", "PROTOCOL-SNMP request tcp" ], "sightings": 7067, "tags": [ "icmp", "tcp", "ssh", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.220.1.106", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "3.124.193.147", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.96.145", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.239.228.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.187.128.134", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "70.224.227.130", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.145.180", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.177.52", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.217.13.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5025, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.92.25.48", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2515, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "108.136.149.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.152.43.76", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.220.17.163", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:33:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.200.223.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:33:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.174.139.250", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.181.4.47", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.220.137.9", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.126.128.255", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.206.192.98", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.104.141.105", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5020, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.218.251.24", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5014, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.219.99.84", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5005, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "3.36.72.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.199.153", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "92.205.166.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:34:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:34:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 500, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.131.37.50", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4984, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.3.216", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "72.41.0.185", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:35:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4975, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.231.196.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:35:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3730, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.83.112", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:35:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.242.75.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:35:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.164.205.238", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:35:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "157.175.152.209", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:35:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:35:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.199.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:39:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2574, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.165.174", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.144.77.252", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.104.126.8", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:36:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.187.249.203", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:36:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.195.220.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:36:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:36:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4958, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.187.198.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:37:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.130.38", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:37:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:37:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.226.96.182", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.48.104.65", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.208.183.178", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.49.34", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.219.101.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4935, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "18.132.9.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4924, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.205.8.184", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3690, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.106.146.208", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.125.190.58", "classifications": [], "first_seen": { "$date": "2023-01-30T13:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:59:14Z" }, "ports": [ 53344, 34977, 51127, 54527, 44265, 45484, 59082 ], "reporting_nodes": 2, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 276, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.145.128.176", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.88.65.44", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.169.68.194", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.235.69.56", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2460, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.233.138.144", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.125.33.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4919, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.245.145.145", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4891, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.181.16.147", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:38:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4890, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.198.89.220", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:38:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.187.192.85", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.177.138.218", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2440, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.38.171.18", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.142.189.177", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3660, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.203.199.249", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.69.18.76", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.113.194.193", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4880, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.142.74.101", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3654, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.193.31.246", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.183.15.99", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.187.241.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.220.216.184", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.227.165.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3645, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.89.240.166", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3645, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.12.211.215", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.73.112.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.236.112.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:39:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:39:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1215, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.29.219.9", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:40:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.184.181.65", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:40:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.244.100.53", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:40:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4860, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "15.220.83.202", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:40:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.21.101.60", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:40:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2420, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "130.211.71.232", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:40:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "50.116.13.32", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "4.193.216.23", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:40:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.66.112.47", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:41:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "157.55.187.200", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:41:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.150.105.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:41:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 484, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.231.124.83", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:41:33Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:41:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.233.15.14", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:41:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:42:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3624, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "101.36.102.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:45:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:45:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 482, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.192.13", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:47:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:04:41Z" }, "ports": [ 161, 0, 5060 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch", "PROTOCOL-SNMP public access udp" ], "sightings": 4923, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "113.61.204.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:47:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:48:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 482, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.91.212.57", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:49:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:49:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2407, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "20.222.145.126", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:50:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:50:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3600, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.206.15", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:50:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:47:09Z" }, "ports": [ 161, 0, 22 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1310, "tags": [ "udp", "snmp", "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.197.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T13:53:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:39:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.172.189.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:53:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:10:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46485, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.92.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:02:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:16:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2078, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.77.112.125", "classifications": [], "first_seen": { "$date": "2023-01-30T14:06:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:51:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 7380, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "159.65.47.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:06:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:06:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.87.230.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T14:07:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:24:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1920, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "97.74.92.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T14:10:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T05:06:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13241, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.166.156.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T14:11:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:24:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 22" ], "sightings": 1921, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.225.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:19:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:26:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.8.145.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:20:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:06:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 958, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.135.227.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T14:22:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:53:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 10" ], "sightings": 2014, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "167.248.133.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:23:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:34:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1592, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.150.83", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T14:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:25:11Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 240, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.140.72.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:27:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:27:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.144.79.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T14:27:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:16:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102", "ET SCAN Potential SSH Scan" ], "sightings": 36577, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "211.107.122.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T14:31:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:31:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 480, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.113.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:31:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:43:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 960, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.38.53.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T14:32:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:52:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 867, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "87.236.176.229", "classifications": [], "first_seen": { "$date": "2023-01-30T14:33:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:33:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 240, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "173.212.222.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T14:35:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:46:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1710, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.55.0.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:36:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:36:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.243.15", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:41:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:59:26Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9408, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.102.221", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:42:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:42:06Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 720, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "5.39.220.40", "classifications": [], "first_seen": { "$date": "2023-01-30T14:50:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:50:37Z" }, "ports": [ 990 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 240, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.222.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T14:55:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:42:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28376, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.129.217.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:01:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:34:06Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13714, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.1.79.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:03:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:03:56Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 720, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "114.171.247.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:08:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:08:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.49.230.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:11:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:11:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:14:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:27:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3914, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:15:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:15:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:11:06Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET CINS Active Threat Intelligence Poor Reputation IP group 98" ], "sightings": 4830, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "128.1.40.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:18:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:18:19Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 719, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.216.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:21:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:21:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.204.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:26:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:22:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3930, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.101.51.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:30:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:31:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream after TCP reset sent" ], "sightings": 956, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.21.238.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:34:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:34:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 239, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.108.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:37:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:19:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7170, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.110.242.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:38:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:50:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1687, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.187.67.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:42:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:43:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.45.89.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:45:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:46:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.226.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T15:47:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:47:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.42", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-01-30T15:55:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:06:38Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1335, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "2.231.46.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:59:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:00:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.105.170.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:59:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:59:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.99.234.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:09:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:31:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3107, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.57.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:09:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:33:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 31", "ET 3CORESec Poor Reputation IP group 11", "ET SCAN Potential SSH Scan" ], "sightings": 3066, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "103.143.10.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:10:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:25:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2390, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.118.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:11:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:13:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 71" ], "sightings": 2391, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.236.164.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:11:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:43:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7033, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.132.183.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:24:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:24:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.167.240.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T16:25:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:25:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.40.56.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T16:33:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:33:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.193.212.121", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T16:40:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:40:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1195, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "109.93.201.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T16:42:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:42:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.181.51.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:45:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:46:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.133.191.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:46:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.183.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:48:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:49:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.196.120.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:52:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:46:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3042, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.45.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T16:52:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:15:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 952, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.60.254.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:38:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 887, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.97.117.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T16:59:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:59:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.98.244.112", "classifications": [], "first_seen": { "$date": "2023-01-30T17:03:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:03:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "88.198.65.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:11:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:11:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.153.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:15:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:15:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.34.204.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:15:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:15:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.157.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:22:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:22:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.38.54.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T17:23:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:24:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.175.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T17:25:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:25:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.182.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:33:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:29:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 952, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.151.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:33:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:06:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26034, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.207.21.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:34:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:34:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.218.166.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:39:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:39:46Z" }, "ports": [ 0, 6060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) method is unknown" ], "sightings": 1190, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "119.220.177.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T17:43:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:43:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.118.0.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T17:47:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:47:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.150.77.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T17:49:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:10:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5016, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.120.180.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T17:51:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:59:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4338, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.39.185.12", "classifications": [], "first_seen": { "$date": "2023-01-30T17:58:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:04:32Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 952, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.181.195.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:05:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:05:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.105.103.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:37:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:37:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 238, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "71.6.232.22", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T18:39:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:52:35Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11264, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "62.210.127.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T18:39:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:39:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.189.176.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:39:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:40:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.138.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T18:45:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:45:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.144.238", "classifications": [], "first_seen": { "$date": "2023-01-30T18:55:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:23:38Z" }, "ports": [ 5001, 8080, 3389, 9000, 6443, 3306, 50001, 7443, 8888, 993, 995 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 36714, "tags": [ "tcp", "http", "rdp", "mysql" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.31.135.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:04:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:21:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1904, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.161.109.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:05:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:05:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.237.46.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:06:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:19:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1904, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.208.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T19:08:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:08:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.117.108.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:09:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:09:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.57.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T19:14:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:14:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.241.95.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T19:16:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:36:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8214, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.84.75.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:17:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:17:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.62.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:20:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.143.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T19:21:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:21:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.136.52.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T19:23:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:23:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.142", "classifications": [ "Information Leak", "Misc activity", "Executable code was detected", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T19:27:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:41:46Z" }, "ports": [ 0, 22, 1900, 53, 5632 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response" ], "sightings": 48554, "tags": [ "icmp", "ssh", "tcp", "ZGrab", "udp" ], "rule_count": 9, "classification_count": 5 }, { "ioc": "122.116.54.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:30:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:30:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.49", "classifications": [ "Misc activity", "Executable code was detected", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-30T19:30:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:38:56Z" }, "ports": [ 1434, 0, 22, 1900 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 19334, "tags": [ "udp", "icmp", "tcp", "ssh" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "89.208.103.100", "classifications": [], "first_seen": { "$date": "2023-01-30T19:40:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:40:51Z" }, "ports": [ 41122 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 238, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "93.171.7.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T19:42:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:42:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1190, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "14.184.96.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:43:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:43:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.150.97.126", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T19:47:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T20:32:47Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 2952, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "128.199.91.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:50:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:54:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 741, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.116.41.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:51:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:40:54Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174" ], "sightings": 53116, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.190.166.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:53:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:53:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 238, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.227.41.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:53:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:26:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4998, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.110.188.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:53:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:25:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42061, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.126.232.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:54:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:11:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81" ], "sightings": 23346, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.50.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:55:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:05:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1904, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.110.12.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T19:59:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:07:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 480, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.39.61.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T20:05:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:05:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.221.82.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:10:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:25:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1904, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.141.11", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T20:13:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:13:00Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 952, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.143.28", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-01-30T20:13:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:14:39Z" }, "ports": [ 161, 0, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 8045, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "102.167.249.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T20:15:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:15:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.100.177.172", "classifications": [], "first_seen": { "$date": "2023-01-30T20:17:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:17:02Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 714, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "37.139.4.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:23:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T16:30:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50430, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "141.95.1.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:26:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:39:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10178, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.70.42.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:26:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:27:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.54.190.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:29:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:42:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15061, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.92.206.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:31:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:43:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17978, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.117.185.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:31:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:32:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.160.244.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:32:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:45:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23596, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.174.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:32:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:48:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26729, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.27.101.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:34:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T18:54:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187" ], "sightings": 26492, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.79.142.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T20:35:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:03:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 80686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.34.17.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:45:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:34:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 3" ], "sightings": 6514, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.248.175.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T20:45:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:45:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.157.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:53:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:53:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.86.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T20:56:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:56:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.36.40.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T20:56:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:57:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.43.62.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T20:58:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:58:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.118.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:06:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:06:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11668, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.221.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:08:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:08:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.45.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:11:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:36:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11668, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.13.77.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T21:12:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:13:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.170", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T21:13:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:06:13Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 7958, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "95.86.99.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:15:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:30:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16180, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.225.207.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:23:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:23:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.129.35.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:26:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:25:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30628, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.123.244.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T21:29:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:31:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.150.105.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:40:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:40:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.243.215.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T21:43:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:44:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.245.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:12:45Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 27753, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.136.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:47:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:42:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13387, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.178.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T21:52:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:53:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.113.214.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T21:57:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:57:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.252.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T22:16:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:16:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.166.227.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:17:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:30:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 23336, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.145.209.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:18:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:24:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22348, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.235.106.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T22:31:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:31:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.47.68.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:37:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:38:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.236.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:42:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:54:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17502, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "191.96.36.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T22:42:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:42:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17502, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.205.189.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:45:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:46:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5834, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T22:45:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:27:53Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 5836, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "35.235.92.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T22:51:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:51:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.42.34.224", "classifications": [], "first_seen": { "$date": "2023-01-28T03:20:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:40:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 302, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.127.237.234", "classifications": [], "first_seen": { "$date": "2023-01-28T03:43:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:44:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 55", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 645, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "212.8.116.110", "classifications": [], "first_seen": { "$date": "2023-01-28T03:45:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T03:45:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 430, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.4p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "34.237.137.22", "classifications": [], "first_seen": { "$date": "2023-01-28T04:04:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:42:33Z" }, "ports": [ 57090, 42298, 36596 ], "reporting_nodes": 1, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management" ], "sightings": 1798, "tags": [ "alert", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.234.242.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T04:09:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:38:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 217, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "106.245.150.151", "classifications": [], "first_seen": { "$date": "2023-01-28T04:11:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:11:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 215, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.134.188.181", "classifications": [], "first_seen": { "$date": "2023-01-28T04:22:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:22:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 215, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "117.50.160.88", "classifications": [], "first_seen": { "$date": "2023-01-28T04:32:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:12:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 19187, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "114.132.77.113", "classifications": [], "first_seen": { "$date": "2023-01-28T04:34:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:39:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 14190, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "207.44.115.186", "classifications": [], "first_seen": { "$date": "2023-01-28T04:40:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:40:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 215, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.134.84.64", "classifications": [], "first_seen": { "$date": "2023-01-28T04:42:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:42:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 215, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "84.94.120.125", "classifications": [], "first_seen": { "$date": "2023-01-28T04:54:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T04:54:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 82" ], "sightings": 430, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.228.161.61", "classifications": [], "first_seen": { "$date": "2023-01-28T05:11:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:11:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 430, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "123.193.151.17", "classifications": [], "first_seen": { "$date": "2023-01-28T05:45:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:45:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 9", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 860, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "153.172.161.58", "classifications": [], "first_seen": { "$date": "2023-01-28T05:45:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T05:45:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 215, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "118.70.128.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T05:53:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:15:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 20", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33007, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.117.239.226", "classifications": [], "first_seen": { "$date": "2023-01-28T06:01:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:15:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4074, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "172.104.11.51", "classifications": [], "first_seen": { "$date": "2023-01-28T06:13:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:14:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1948, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.170.168.99", "classifications": [], "first_seen": { "$date": "2023-01-28T06:14:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:14:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 215, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "145.239.43.138", "classifications": [], "first_seen": { "$date": "2023-01-28T06:26:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:26:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 214, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.177.172.76", "classifications": [], "first_seen": { "$date": "2023-01-28T06:28:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:52:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 40", "ET SCAN Potential SSH Scan" ], "sightings": 1073, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "116.235.68.40", "classifications": [], "first_seen": { "$date": "2023-01-28T06:37:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:42:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 428, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "89.248.163.62", "classifications": [], "first_seen": { "$date": "2023-01-28T06:56:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T06:56:05Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 214, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "123.60.159.154", "classifications": [], "first_seen": { "$date": "2023-01-28T06:59:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:06:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2354, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.224.201.63", "classifications": [], "first_seen": { "$date": "2023-01-28T07:13:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:13:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 97" ], "sightings": 642, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.125", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T07:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:05:52Z" }, "ports": [ 22, 0, 177 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 2776, "tags": [ "alert", "tcp", "ssh", "icmp", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.133", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-28T07:19:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:55:17Z" }, "ports": [ 22, 0, 1900 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 9184, "tags": [ "alert", "tcp", "ssh", "Go", "icmp", "udp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "187.89.240.143", "classifications": [], "first_seen": { "$date": "2023-01-28T07:31:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:46:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1925, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "222.118.106.106", "classifications": [], "first_seen": { "$date": "2023-01-28T07:55:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T07:55:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 214, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "128.199.16.6", "classifications": [], "first_seen": { "$date": "2023-01-28T08:05:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:17:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25" ], "sightings": 8338, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.197.46.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:07:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T03:09:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7478, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.117.239.170", "classifications": [], "first_seen": { "$date": "2023-01-28T08:09:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:26:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1712, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "170.64.156.206", "classifications": [], "first_seen": { "$date": "2023-01-28T08:12:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:23:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 78" ], "sightings": 8123, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.183.74.59", "classifications": [], "first_seen": { "$date": "2023-01-28T08:13:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:13:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 5" ], "sightings": 214, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.154.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T08:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:50:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8148, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.241.70.56", "classifications": [], "first_seen": { "$date": "2023-01-28T08:16:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:12:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 66" ], "sightings": 8554, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.157.26.169", "classifications": [], "first_seen": { "$date": "2023-01-28T08:17:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:17:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 154" ], "sightings": 214, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.227.46.127", "classifications": [], "first_seen": { "$date": "2023-01-28T08:17:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:17:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 173" ], "sightings": 214, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "36.237.34.198", "classifications": [], "first_seen": { "$date": "2023-01-28T08:43:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:43:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 214, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "36.136.57.130", "classifications": [], "first_seen": { "$date": "2023-01-28T08:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T08:47:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 642, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "177.106.10.138", "classifications": [], "first_seen": { "$date": "2023-01-28T08:59:59Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:00:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1070, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.122.204.26", "classifications": [], "first_seen": { "$date": "2023-01-28T09:03:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:43:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 425, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "202.186.70.17", "classifications": [], "first_seen": { "$date": "2023-01-28T09:40:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:47:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 217, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.251.16.224", "classifications": [], "first_seen": { "$date": "2023-01-28T09:49:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:49:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 36" ], "sightings": 213, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.42.31.76", "classifications": [], "first_seen": { "$date": "2023-01-28T09:49:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:40:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6390, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.99.247.60", "classifications": [], "first_seen": { "$date": "2023-01-28T09:50:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:50:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105" ], "sightings": 213, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.109.198", "classifications": [], "first_seen": { "$date": "2023-01-28T09:50:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:06:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55" ], "sightings": 8086, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.161.106.161", "classifications": [], "first_seen": { "$date": "2023-01-28T09:50:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T09:50:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 213, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "193.151.145.227", "classifications": [], "first_seen": { "$date": "2023-01-28T09:51:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:07:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1491, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "186.167.67.106", "classifications": [], "first_seen": { "$date": "2023-01-28T09:51:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:43:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6390, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.162.110.120", "classifications": [], "first_seen": { "$date": "2023-01-28T09:57:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:12:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1491, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "82.64.32.76", "classifications": [], "first_seen": { "$date": "2023-01-28T09:58:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:55:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 182", "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 8946, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "34.29.61.53", "classifications": [], "first_seen": { "$date": "2023-01-28T09:59:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:48:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 138", "ET SCAN Potential SSH Scan" ], "sightings": 260, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "121.140.186.197", "classifications": [], "first_seen": { "$date": "2023-01-28T10:00:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:00:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 213, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "121.178.180.231", "classifications": [], "first_seen": { "$date": "2023-01-28T10:41:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:41:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 213, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "143.110.179.115", "classifications": [], "first_seen": { "$date": "2023-01-28T10:41:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T10:41:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 13" ], "sightings": 213, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "217.17.230.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:01:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:11:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 130", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19605, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.88.81", "classifications": [], "first_seen": { "$date": "2023-01-28T11:03:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:01:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 164" ], "sightings": 8697, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "13.67.221.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:03:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:56:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 33", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 13573, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "157.230.234.46", "classifications": [], "first_seen": { "$date": "2023-01-28T11:04:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:04:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55" ], "sightings": 213, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.9.150.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:32:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:29:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 78", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2760, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "157.245.244.131", "classifications": [], "first_seen": { "$date": "2023-01-28T11:38:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:34:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "ET SCAN Potential SSH Scan" ], "sightings": 9109, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "184.183.198.52", "classifications": [], "first_seen": { "$date": "2023-01-28T11:39:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:39:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 212, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "143.198.81.56", "classifications": [], "first_seen": { "$date": "2023-01-28T11:39:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:52:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1484, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "129.226.213.186", "classifications": [], "first_seen": { "$date": "2023-01-28T11:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:50:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 29", "ET SCAN Potential SSH Scan" ], "sightings": 260, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "159.65.103.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:41:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:43:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 60", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48748, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.42.44.178", "classifications": [], "first_seen": { "$date": "2023-01-28T11:42:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:51:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 123" ], "sightings": 7836, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.183.225.151", "classifications": [], "first_seen": { "$date": "2023-01-28T11:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:51:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 175" ], "sightings": 547, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "190.156.231.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T11:43:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:34:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102", "ET 3CORESec Poor Reputation IP group 24", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 42694, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "218.150.144.219", "classifications": [], "first_seen": { "$date": "2023-01-28T11:49:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T11:49:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 212, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "34.101.130.42", "classifications": [], "first_seen": { "$date": "2023-01-28T12:02:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:02:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 137" ], "sightings": 212, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.252.140.21", "classifications": [], "first_seen": { "$date": "2023-01-28T12:02:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:29:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 186" ], "sightings": 225, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "164.77.119.34", "classifications": [], "first_seen": { "$date": "2023-01-28T12:10:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:15:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 67", "ET 3CORESec Poor Reputation IP group 16" ], "sightings": 13139, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.126.159.195", "classifications": [], "first_seen": { "$date": "2023-01-28T12:30:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T12:30:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 50" ], "sightings": 424, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "203.245.29.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T13:14:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:23:00Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1410, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.61.105", "classifications": [], "first_seen": { "$date": "2023-01-28T13:16:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:30:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2120, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.206.93.110", "classifications": [], "first_seen": { "$date": "2023-01-28T13:52:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T13:52:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 212, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "221.159.7.211", "classifications": [], "first_seen": { "$date": "2023-01-28T14:07:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:07:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 212, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "118.47.97.55", "classifications": [], "first_seen": { "$date": "2023-01-28T14:07:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:07:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 424, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.191.47.106", "classifications": [], "first_seen": { "$date": "2023-01-28T14:09:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:09:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 212, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "216.176.121.106", "classifications": [], "first_seen": { "$date": "2023-01-28T14:10:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:10:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 212, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "73.45.66.179", "classifications": [], "first_seen": { "$date": "2023-01-28T14:12:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:12:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 74" ], "sightings": 424, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.170.198.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:28:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:33:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 215, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.20.44", "classifications": [], "first_seen": { "$date": "2023-01-28T14:37:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T14:37:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 212, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.99.178.193", "classifications": [], "first_seen": { "$date": "2023-01-28T14:56:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:07:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 10" ], "sightings": 12507, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.4.103.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T14:58:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:28:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 58", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4648, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "54.39.90.160", "classifications": [], "first_seen": { "$date": "2023-01-28T14:58:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 168" ], "sightings": 9868, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "82.200.226.226", "classifications": [], "first_seen": { "$date": "2023-01-28T14:59:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:13:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1693, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "64.62.197.150", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-28T15:02:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:08:36Z" }, "ports": [ 80, 0, 177 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 7453, "tags": [ "alert", "tcp", "http", "icmp", "udp", "xdmcp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.198.116.224", "classifications": [], "first_seen": { "$date": "2023-01-28T15:25:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:16:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan", "SURICATA STREAM Packet with invalid timestamp", "SURICATA TCPv4 invalid checksum" ], "sightings": 90443, "tags": [ "ssh", "tcp", "ssh", "Go", "ssh", "alert" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "118.233.221.101", "classifications": [], "first_seen": { "$date": "2023-01-28T15:29:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:29:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 422, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "110.249.218.126", "classifications": [], "first_seen": { "$date": "2023-01-28T15:31:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:31:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 633, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.129.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T15:35:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:57:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10618, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.234.81", "classifications": [], "first_seen": { "$date": "2023-01-28T15:37:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:34:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34", "ET SCAN Potential SSH Scan" ], "sightings": 8213, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.21.52.123", "classifications": [], "first_seen": { "$date": "2023-01-28T15:39:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T15:54:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2109, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "1.34.63.10", "classifications": [], "first_seen": { "$date": "2023-01-28T16:14:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:14:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 3" ], "sightings": 633, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.35.56.150", "classifications": [], "first_seen": { "$date": "2023-01-28T16:24:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:24:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 633, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "179.235.116.110", "classifications": [], "first_seen": { "$date": "2023-01-28T16:27:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:27:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 211, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "82.223.36.97", "classifications": [], "first_seen": { "$date": "2023-01-28T16:28:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T16:43:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1899, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "221.164.132.237", "classifications": [], "first_seen": { "$date": "2023-01-28T17:25:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:25:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 211, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "188.217.61.236", "classifications": [], "first_seen": { "$date": "2023-01-28T17:25:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:25:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 211, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "112.173.125.118", "classifications": [], "first_seen": { "$date": "2023-01-28T17:48:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:43:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 234, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.35.38.115", "classifications": [], "first_seen": { "$date": "2023-01-28T17:55:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T17:55:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 422, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "172.104.249.218", "classifications": [], "first_seen": { "$date": "2023-01-28T18:15:47Z" }, "ja3": [ "19e29534fd49dd27d09234e639c4057e" ], "last_seen": { "$date": "2023-01-28T18:15:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "REQUEST_BODY_UNEXPECTED", "SURICATA HTTP Unexpected Request body" ], "sightings": 636, "tags": [ "alert", "tcp", "ssh", "anomaly", "tls", "http" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "213.45.189.251", "classifications": [], "first_seen": { "$date": "2023-01-28T18:30:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:30:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "123.240.248.178", "classifications": [], "first_seen": { "$date": "2023-01-28T18:38:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:38:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.203.66.34", "classifications": [], "first_seen": { "$date": "2023-01-28T18:49:58Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T18:50:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "34.88.233.94", "classifications": [], "first_seen": { "$date": "2023-01-28T20:03:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:03:31Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 21" ], "sightings": 1, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.52.249.176", "classifications": [], "first_seen": { "$date": "2023-01-28T20:09:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:15:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.146.140.152", "classifications": [], "first_seen": { "$date": "2023-01-28T20:18:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:29:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 3" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "67.79.105.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:19:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:47:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2919, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.32.21.175", "classifications": [], "first_seen": { "$date": "2023-01-28T20:20:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:20:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 141" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "203.205.37.224", "classifications": [], "first_seen": { "$date": "2023-01-28T20:21:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:20:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120" ], "sightings": 106, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.48.196.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T20:22:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:32:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 88", "ET 3CORESec Poor Reputation IP group 21", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18285, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "165.154.240.15", "classifications": [], "first_seen": { "$date": "2023-01-28T20:28:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:57:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "49.236.204.16", "classifications": [], "first_seen": { "$date": "2023-01-28T20:29:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:10:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 162", "ET SCAN Potential SSH Scan" ], "sightings": 54, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "114.32.223.238", "classifications": [], "first_seen": { "$date": "2023-01-28T20:35:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T20:35:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.34.6.102", "classifications": [], "first_seen": { "$date": "2023-01-28T21:47:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:47:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "219.85.90.186", "classifications": [], "first_seen": { "$date": "2023-01-28T21:50:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:50:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "118.200.6.179", "classifications": [], "first_seen": { "$date": "2023-01-28T21:50:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T21:50:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "49.233.13.30", "classifications": [], "first_seen": { "$date": "2023-01-28T22:10:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:05:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 11060, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "122.117.61.214", "classifications": [], "first_seen": { "$date": "2023-01-28T22:13:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:13:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "203.229.159.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T22:28:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:40:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4109, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.154.38.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T22:28:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T16:37:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10885, "tags": [ "ssh", "tcp", "ssh", "HELLOWORLD", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.33.80.179", "classifications": [], "first_seen": { "$date": "2023-01-28T22:37:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:37:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 7" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.169.22.187", "classifications": [], "first_seen": { "$date": "2023-01-28T22:42:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T22:55:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.229.44.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-28T22:47:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:27:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9130, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.227.21.70", "classifications": [], "first_seen": { "$date": "2023-01-28T22:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:36:23Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 30402, "tags": [ "alert", "tcp", "ssh", "Go", "icmp" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "116.118.49.107", "classifications": [], "first_seen": { "$date": "2023-01-28T23:04:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:04:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 18" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "83.235.16.111", "classifications": [], "first_seen": { "$date": "2023-01-28T23:08:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:39:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 183", "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 1290, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "174.138.64.63", "classifications": [], "first_seen": { "$date": "2023-01-28T23:08:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:03:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 80", "ET SCAN Potential SSH Scan" ], "sightings": 41, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "90.63.157.197", "classifications": [], "first_seen": { "$date": "2023-01-28T23:10:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-28T23:10:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.229.24.184", "classifications": [], "first_seen": { "$date": "2023-01-29T00:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T00:16:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.133.144.99", "classifications": [], "first_seen": { "$date": "2023-01-29T01:02:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:02:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "121.143.212.32", "classifications": [], "first_seen": { "$date": "2023-01-29T01:25:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:25:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 8" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.172.187.120", "classifications": [], "first_seen": { "$date": "2023-01-29T01:26:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:58:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 74", "ET SCAN Potential SSH Scan" ], "sightings": 494, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "221.149.227.94", "classifications": [], "first_seen": { "$date": "2023-01-29T01:36:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:36:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "80.19.204.177", "classifications": [], "first_seen": { "$date": "2023-01-29T01:51:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:51:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 180" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "177.93.51.98", "classifications": [], "first_seen": { "$date": "2023-01-29T01:51:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T01:51:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "134.209.127.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T02:40:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:53:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 31", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.226.151", "classifications": [], "first_seen": { "$date": "2023-01-29T02:41:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:56:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.223.32.202", "classifications": [], "first_seen": { "$date": "2023-01-29T02:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T03:01:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "129.151.250.217", "classifications": [], "first_seen": { "$date": "2023-01-29T02:43:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:14:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 28" ], "sightings": 23, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.117.67.146", "classifications": [], "first_seen": { "$date": "2023-01-29T02:43:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:43:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.153.17.76", "classifications": [], "first_seen": { "$date": "2023-01-29T02:44:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T02:44:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 149" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "58.246.241.110", "classifications": [], "first_seen": { "$date": "2023-01-29T03:07:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:03:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 3258, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "84.39.254.211", "classifications": [], "first_seen": { "$date": "2023-01-29T03:07:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T03:13:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "188.166.225.37", "classifications": [], "first_seen": { "$date": "2023-01-29T03:09:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:16:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 98", "ET 3CORESec Poor Reputation IP group 23" ], "sightings": 62, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.107.214.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:09:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:38:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 160", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27999, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.202.18.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T03:14:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:38:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM FIN out of window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60209, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.145.209.57", "classifications": [], "first_seen": { "$date": "2023-01-29T03:15:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:22:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 15, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.98.201.128", "classifications": [], "first_seen": { "$date": "2023-01-29T03:18:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T03:18:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.69.196.118", "classifications": [], "first_seen": { "$date": "2023-01-29T03:39:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T03:39:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.9", "classifications": [], "first_seen": { "$date": "2023-01-29T03:40:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T03:40:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.9.5.153", "classifications": [], "first_seen": { "$date": "2023-01-29T03:54:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T03:54:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 78" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.248.133.60", "classifications": [], "first_seen": { "$date": "2023-01-29T03:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T03:56:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "179.113.131.202", "classifications": [], "first_seen": { "$date": "2023-01-29T04:02:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:02:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.135.149.208", "classifications": [], "first_seen": { "$date": "2023-01-29T04:05:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:06:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.225.19.94", "classifications": [], "first_seen": { "$date": "2023-01-29T04:18:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:33:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "47.157.239.55", "classifications": [], "first_seen": { "$date": "2023-01-29T04:21:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:33:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "171.239.129.61", "classifications": [], "first_seen": { "$date": "2023-01-29T04:24:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:24:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "115.138.134.198", "classifications": [], "first_seen": { "$date": "2023-01-29T04:34:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:34:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.141.105.146", "classifications": [], "first_seen": { "$date": "2023-01-29T04:36:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:36:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "183.106.58.66", "classifications": [], "first_seen": { "$date": "2023-01-29T04:38:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:38:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.81.57.133", "classifications": [], "first_seen": { "$date": "2023-01-29T04:47:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:10:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 64", "ET SCAN Potential SSH Scan" ], "sightings": 117, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "218.150.239.195", "classifications": [], "first_seen": { "$date": "2023-01-29T04:49:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T04:49:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "152.32.247.67", "classifications": [], "first_seen": { "$date": "2023-01-29T05:15:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T05:17:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "172.105.128.12", "classifications": [], "first_seen": { "$date": "2023-01-29T06:10:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T18:13:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 18", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 213, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "87.6.150.116", "classifications": [], "first_seen": { "$date": "2023-01-29T06:11:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:11:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.142.135.16", "classifications": [], "first_seen": { "$date": "2023-01-29T06:40:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:40:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "2620:002d:4000:0001:0000:0000:0000:002a", "classifications": [], "first_seen": { "$date": "2023-01-29T06:50:42Z" }, "ja3": [ "e0ff89ed9185dfb09184797a4c3f2e1c" ], "last_seen": { "$date": "2023-03-03T17:21:05Z" }, "ports": [ 43940, 60694 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "183.171.204.112", "classifications": [], "first_seen": { "$date": "2023-01-29T06:55:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T06:55:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.216.131.31", "classifications": [], "first_seen": { "$date": "2023-01-29T06:59:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:09:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 170" ], "sightings": 50, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "119.31.123.140", "classifications": [], "first_seen": { "$date": "2023-01-29T07:07:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:07:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 21" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.114.196.46", "classifications": [], "first_seen": { "$date": "2023-01-29T07:09:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:24:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.155.175.218", "classifications": [], "first_seen": { "$date": "2023-01-29T07:10:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:26:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "122.184.65.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T07:12:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:49:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 22", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54476, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.246.181.38", "classifications": [], "first_seen": { "$date": "2023-01-29T07:12:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:13:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.155.57.10", "classifications": [], "first_seen": { "$date": "2023-01-29T07:25:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:30:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 85, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "112.165.43.59", "classifications": [], "first_seen": { "$date": "2023-01-29T07:41:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T07:41:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 4" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "190.145.192.106", "classifications": [], "first_seen": { "$date": "2023-01-29T08:37:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:42:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102" ], "sightings": 62, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "129.146.242.59", "classifications": [], "first_seen": { "$date": "2023-01-29T08:38:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T08:38:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 28" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.16.202.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:39:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:17:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 4", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12385, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.241.124.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T08:41:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:35:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 65", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55422, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.12.163.205", "classifications": [], "first_seen": { "$date": "2023-01-29T09:08:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:08:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 23" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.107.213.219", "classifications": [], "first_seen": { "$date": "2023-01-29T09:28:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:17:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 87, "tags": [ "ssh", "tcp", "ssh", "HELLOWORLD", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.92.2.30", "classifications": [], "first_seen": { "$date": "2023-01-29T09:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:47:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "1.170.15.26", "classifications": [], "first_seen": { "$date": "2023-01-29T09:57:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T09:58:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "121.179.242.186", "classifications": [], "first_seen": { "$date": "2023-01-29T10:26:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T10:26:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "73.198.151.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T10:41:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T02:40:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 74", "ET 3CORESec Poor Reputation IP group 43", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18296, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "157.245.227.165", "classifications": [], "first_seen": { "$date": "2023-01-29T10:55:09Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:00:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "81.177.6.164", "classifications": [], "first_seen": { "$date": "2023-01-29T10:55:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:49:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 31, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "222.98.75.108", "classifications": [], "first_seen": { "$date": "2023-01-29T11:12:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:12:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.218.241.80", "classifications": [], "first_seen": { "$date": "2023-01-29T11:16:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:30:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.133.195.177", "classifications": [], "first_seen": { "$date": "2023-01-29T11:17:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:17:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.126.8.102", "classifications": [], "first_seen": { "$date": "2023-01-29T11:20:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T06:34:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 91", "ET SCAN Potential SSH Scan" ], "sightings": 2562, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "52.187.109.0", "classifications": [], "first_seen": { "$date": "2023-01-29T11:20:40Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T06:23:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 167", "ET 3CORESec Poor Reputation IP group 38" ], "sightings": 709, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "128.199.233.130", "classifications": [], "first_seen": { "$date": "2023-01-29T11:28:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:42:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.235.199.37", "classifications": [], "first_seen": { "$date": "2023-01-29T11:32:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:11:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 7", "ET SCAN Potential SSH Scan" ], "sightings": 53, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "111.62.142.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T11:39:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:38:10Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET 3CORESec Poor Reputation IP group 4", "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1684, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "122.116.241.113", "classifications": [], "first_seen": { "$date": "2023-01-29T11:44:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:44:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "62.171.167.183", "classifications": [], "first_seen": { "$date": "2023-01-29T11:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T11:56:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.214.215.148", "classifications": [], "first_seen": { "$date": "2023-01-29T12:02:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:02:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "223.194.30.95", "classifications": [], "first_seen": { "$date": "2023-01-29T12:31:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:41:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM FIN out of window" ], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.5", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "222.103.54.183", "classifications": [], "first_seen": { "$date": "2023-01-29T12:36:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:36:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "154.120.242.70", "classifications": [], "first_seen": { "$date": "2023-01-29T12:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:23:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 53" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "36.94.152.63", "classifications": [], "first_seen": { "$date": "2023-01-29T12:50:43Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T12:50:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 140" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.197.233.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T12:54:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:42:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18565, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.27", "classifications": [], "first_seen": { "$date": "2023-01-29T13:06:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:06:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "62.89.30.62", "classifications": [], "first_seen": { "$date": "2023-01-29T13:16:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:16:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 66" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.236.176.98", "classifications": [], "first_seen": { "$date": "2023-01-29T13:23:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:25:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.190", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-29T13:56:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:15:44Z" }, "ports": [ 80, 0 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28673, "tags": [ "alert", "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "180.11.87.20", "classifications": [], "first_seen": { "$date": "2023-01-29T13:56:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T13:56:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "221.156.77.64", "classifications": [], "first_seen": { "$date": "2023-01-29T14:21:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:21:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 32" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "93.151.252.201", "classifications": [], "first_seen": { "$date": "2023-01-29T14:22:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:22:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 88" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "172.80.57.9", "classifications": [], "first_seen": { "$date": "2023-01-29T14:41:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:42:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 73, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "211.222.26.206", "classifications": [], "first_seen": { "$date": "2023-01-29T14:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:46:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.119.119.150", "classifications": [], "first_seen": { "$date": "2023-01-29T14:54:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T14:54:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.130.104.254", "classifications": [], "first_seen": { "$date": "2023-01-29T15:14:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:14:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "122.116.161.135", "classifications": [], "first_seen": { "$date": "2023-01-29T15:18:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T15:18:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "178.128.152.119", "classifications": [], "first_seen": { "$date": "2023-01-29T15:30:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T15:51:18Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 19" ], "sightings": 33, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.107.122.207", "classifications": [], "first_seen": { "$date": "2023-01-29T16:04:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:04:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "187.57.24.207", "classifications": [], "first_seen": { "$date": "2023-01-29T16:15:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:30:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "132.148.75.52", "classifications": [], "first_seen": { "$date": "2023-01-29T16:35:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:32:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 30", "ET 3CORESec Poor Reputation IP group 11" ], "sightings": 41, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.118.145.221", "classifications": [], "first_seen": { "$date": "2023-01-29T16:37:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:37:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 155" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.102.40.190", "classifications": [], "first_seen": { "$date": "2023-01-29T16:50:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:52:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.167.97.145", "classifications": [], "first_seen": { "$date": "2023-01-29T16:54:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T16:54:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 92" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.90.235.39", "classifications": [], "first_seen": { "$date": "2023-01-29T17:00:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:00:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 98" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.225.124.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:06:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:09:27Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 7", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15181, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "210.126.26.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T17:08:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:40:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11, "tags": [ "ssh", "tcp", "ssh", "HELLOWORLD", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.188.63", "classifications": [], "first_seen": { "$date": "2023-01-29T17:30:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:30:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 67" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.227.188.64", "classifications": [], "first_seen": { "$date": "2023-01-29T17:35:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:35:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 67", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh", "anomaly", "http", "Go" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "138.68.8.81", "classifications": [], "first_seen": { "$date": "2023-01-29T17:35:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:47:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 1109, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.124.71.37", "classifications": [], "first_seen": { "$date": "2023-01-29T17:37:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T17:38:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 48", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "92.246.144.198", "classifications": [], "first_seen": { "$date": "2023-01-29T18:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T18:18:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 87" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.156.172.104", "classifications": [], "first_seen": { "$date": "2023-01-29T18:56:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:19:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "203.128.242.166", "classifications": [], "first_seen": { "$date": "2023-01-29T18:58:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:26:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 566, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "164.90.224.134", "classifications": [], "first_seen": { "$date": "2023-01-29T18:58:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:54:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 67", "ET 3CORESec Poor Reputation IP group 16", "ET SCAN Potential SSH Scan" ], "sightings": 45, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "188.166.102.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T18:59:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:12:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 98", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39624, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.11.5", "classifications": [], "first_seen": { "$date": "2023-01-29T19:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:22:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 60", "ET 3CORESec Poor Reputation IP group 15" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "62.89.5.174", "classifications": [], "first_seen": { "$date": "2023-01-29T19:00:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:15:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.65.249.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:00:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:46:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3797, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "119.202.72.87", "classifications": [], "first_seen": { "$date": "2023-01-29T19:00:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:14:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 21", "ET SCAN Potential SSH Scan" ], "sightings": 24119, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "146.56.162.101", "classifications": [], "first_seen": { "$date": "2023-01-29T19:01:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:34:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49" ], "sightings": 30, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.142.159.158", "classifications": [], "first_seen": { "$date": "2023-01-29T19:01:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:01:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 91" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.132.148.108", "classifications": [], "first_seen": { "$date": "2023-01-29T19:03:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:03:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "186.121.203.115", "classifications": [], "first_seen": { "$date": "2023-01-29T19:21:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:21:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 94" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "101.108.66.188", "classifications": [], "first_seen": { "$date": "2023-01-29T19:29:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:40:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 11, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "182.52.17.100", "classifications": [], "first_seen": { "$date": "2023-01-29T19:30:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:39:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.52.17.133", "classifications": [], "first_seen": { "$date": "2023-01-29T19:31:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:40:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.203.10.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T19:33:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:35:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 58", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19273, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.13.200.193", "classifications": [], "first_seen": { "$date": "2023-01-29T19:36:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:36:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "130.25.12.80", "classifications": [], "first_seen": { "$date": "2023-01-29T19:42:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T19:42:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "111.19.156.4", "classifications": [], "first_seen": { "$date": "2023-01-29T19:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:05:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "64.227.160.152", "classifications": [], "first_seen": { "$date": "2023-01-29T20:05:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:27:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 110, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "109.182.1.10", "classifications": [], "first_seen": { "$date": "2023-01-29T20:38:39Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T20:38:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.137.89.38", "classifications": [], "first_seen": { "$date": "2023-01-29T21:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:20:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 95", "SURICATA TCPv4 invalid checksum" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "121.185.123.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:21:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:58:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1078, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.236.200.254", "classifications": [], "first_seen": { "$date": "2023-01-29T21:22:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:22:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "213.205.209.94", "classifications": [], "first_seen": { "$date": "2023-01-29T21:23:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:20:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "116.147.36.2", "classifications": [], "first_seen": { "$date": "2023-01-29T21:26:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:26:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Spamhaus DROP Listed Traffic Inbound group 9" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.223.218.38", "classifications": [], "first_seen": { "$date": "2023-01-29T21:26:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:26:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "189.7.17.61", "classifications": [], "first_seen": { "$date": "2023-01-29T21:29:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:04:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 101", "ET 3CORESec Poor Reputation IP group 23" ], "sightings": 130, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.156.49.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:32:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:08:48Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10543, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "223.197.186.7", "classifications": [], "first_seen": { "$date": "2023-01-29T21:33:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:47:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "91.107.159.49", "classifications": [], "first_seen": { "$date": "2023-01-29T21:33:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:48:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "101.100.164.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:33:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:09:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 134113, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.239.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:35:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:39:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 36", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38339, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.36.81.81", "classifications": [], "first_seen": { "$date": "2023-01-29T21:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:49:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.255.54.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:37:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:03:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 37", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 18156, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "58.23.17.120", "classifications": [], "first_seen": { "$date": "2023-01-29T21:42:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:42:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 46" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "213.219.180.75", "classifications": [], "first_seen": { "$date": "2023-01-29T21:43:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:43:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh_0.8.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.203.23.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T21:50:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:01:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16311, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.172.255.113", "classifications": [], "first_seen": { "$date": "2023-01-29T21:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:53:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 13" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.131.40.97", "classifications": [], "first_seen": { "$date": "2023-01-29T21:53:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:53:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 10", "ET 3CORESec Poor Reputation IP group 2" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "74.204.129.194", "classifications": [], "first_seen": { "$date": "2023-01-29T21:54:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:54:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 177" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.131.52.157", "classifications": [], "first_seen": { "$date": "2023-01-29T21:55:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 145" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "27.99.9.141", "classifications": [], "first_seen": { "$date": "2023-01-29T21:55:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:55:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 136" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.156.178.191", "classifications": [], "first_seen": { "$date": "2023-01-29T21:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T23:29:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.59.2.8", "classifications": [], "first_seen": { "$date": "2023-01-29T21:56:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:56:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 39" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.132.148.16", "classifications": [], "first_seen": { "$date": "2023-01-29T21:57:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T21:57:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "23.105.194.93", "classifications": [], "first_seen": { "$date": "2023-01-29T22:02:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:11:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 133" ], "sightings": 42, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.223.89.74", "classifications": [], "first_seen": { "$date": "2023-01-29T22:18:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:31:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "163.172.45.44", "classifications": [], "first_seen": { "$date": "2023-01-29T22:18:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:18:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 66" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.163.125.97", "classifications": [], "first_seen": { "$date": "2023-01-29T22:25:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-29T22:25:02Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 1, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "156.236.69.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-29T23:56:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:30:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22126, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.128.136", "classifications": [], "first_seen": { "$date": "2023-01-30T00:59:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T00:59:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 44" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "91.193.129.151", "classifications": [], "first_seen": { "$date": "2023-01-30T01:00:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:56:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 186", "ET SCAN Potential SSH Scan" ], "sightings": 48, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "84.201.172.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T01:03:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:43:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 44", "(stream_tcp) TCP timestamp is outside of PAWS window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42965, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "51.15.1.162", "classifications": [], "first_seen": { "$date": "2023-01-30T01:04:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T01:20:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.225.120.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:25:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14872, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.152.190.132", "classifications": [], "first_seen": { "$date": "2023-01-30T02:20:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:23:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 754, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.136.157.197", "classifications": [], "first_seen": { "$date": "2023-01-30T02:27:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:43:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "84.88.59.1", "classifications": [], "first_seen": { "$date": "2023-01-30T02:28:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:15:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 183", "ET SCAN Potential SSH Scan" ], "sightings": 17583, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "175.141.241.219", "classifications": [], "first_seen": { "$date": "2023-01-30T02:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:38:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.157.7.187", "classifications": [], "first_seen": { "$date": "2023-01-30T02:41:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:21:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 154", "ET SCAN Potential SSH Scan" ], "sightings": 769, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.255.216.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T02:44:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:51:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 7", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3543, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.89.6.122", "classifications": [], "first_seen": { "$date": "2023-01-30T02:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T02:53:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "51.15.211.213", "classifications": [], "first_seen": { "$date": "2023-01-30T02:55:41Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:00:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 82, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "91.207.40.45", "classifications": [], "first_seen": { "$date": "2023-01-30T02:59:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:17:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "138.68.230.183", "classifications": [], "first_seen": { "$date": "2023-01-30T03:00:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:57:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 36", "ET SCAN Potential SSH Scan" ], "sightings": 40, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "91.205.128.170", "classifications": [], "first_seen": { "$date": "2023-01-30T03:00:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:18:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.59.121.221", "classifications": [], "first_seen": { "$date": "2023-01-30T03:01:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:06:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 38" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.235.65.53", "classifications": [], "first_seen": { "$date": "2023-01-30T03:01:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:01:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 97" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "189.178.25.55", "classifications": [], "first_seen": { "$date": "2023-01-30T03:01:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:01:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 100", "ET SCAN Potential SSH Scan" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "190.1.200.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:01:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:01:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 101", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 256, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.236.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:01:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:20:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12985, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.52.64.100", "classifications": [], "first_seen": { "$date": "2023-01-30T03:02:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:02:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 116" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "180.130.116.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:02:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:24:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 20", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6151, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.253.160.51", "classifications": [], "first_seen": { "$date": "2023-01-30T03:03:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:49:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "178.128.102.42", "classifications": [], "first_seen": { "$date": "2023-01-30T03:03:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:23:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 83", "ET SCAN Potential SSH Scan" ], "sightings": 7278, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "82.148.117.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T03:04:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:55:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 181", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7244, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "204.199.161.34", "classifications": [], "first_seen": { "$date": "2023-01-30T03:05:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:16:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.40.57.102", "classifications": [], "first_seen": { "$date": "2023-01-30T03:11:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:13:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "invalid_banner", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 8, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go", "Server" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "83.150.215.253", "classifications": [], "first_seen": { "$date": "2023-01-30T03:34:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:37:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 73, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "197.45.23.245", "classifications": [], "first_seen": { "$date": "2023-01-30T03:37:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:37:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "124.221.104.90", "classifications": [], "first_seen": { "$date": "2023-01-30T03:38:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T03:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 144, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "168.167.72.179", "classifications": [], "first_seen": { "$date": "2023-01-30T04:11:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:50:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1581, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "20.232.30.249", "classifications": [], "first_seen": { "$date": "2023-01-30T04:17:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:17:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 118" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "46.101.9.226", "classifications": [], "first_seen": { "$date": "2023-01-30T04:18:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:32:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.127.128.18", "classifications": [], "first_seen": { "$date": "2023-01-30T04:20:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:20:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 54", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "178.161.243.41", "classifications": [], "first_seen": { "$date": "2023-01-30T04:21:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:36:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "217.182.79.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:21:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:33:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 130", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33720, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.156.248.134", "classifications": [], "first_seen": { "$date": "2023-01-30T04:22:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:07:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153" ], "sightings": 567, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.167.161", "classifications": [], "first_seen": { "$date": "2023-01-30T04:22:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:30:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 26" ], "sightings": 37, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "209.97.161.31", "classifications": [], "first_seen": { "$date": "2023-01-30T04:24:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:30:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 125" ], "sightings": 40, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.146.38.72", "classifications": [], "first_seen": { "$date": "2023-01-30T04:27:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:43:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 107" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "170.106.75.162", "classifications": [], "first_seen": { "$date": "2023-01-30T04:33:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:33:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "209.141.46.19", "classifications": [], "first_seen": { "$date": "2023-01-30T04:49:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:55:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 125" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "178.128.148.229", "classifications": [], "first_seen": { "$date": "2023-01-30T04:50:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:46:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 83", "ET 3CORESec Poor Reputation IP group 19", "ET SCAN Potential SSH Scan" ], "sightings": 43, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "132.148.77.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T04:52:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:03:55Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 30", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 79194, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.72.214.166", "classifications": [], "first_seen": { "$date": "2023-01-30T04:53:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:53:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 128" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.228.137.139", "classifications": [], "first_seen": { "$date": "2023-01-30T04:59:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T04:59:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan" ], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "94.188.177.110", "classifications": [], "first_seen": { "$date": "2023-01-30T05:03:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:07:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 189" ], "sightings": 99, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.163.230.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:03:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:32:27Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 4", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55482, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.34.76.249", "classifications": [], "first_seen": { "$date": "2023-01-30T05:05:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:05:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 3", "ET 3CORESec Poor Reputation IP group 1" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.134.239.49", "classifications": [], "first_seen": { "$date": "2023-01-30T05:07:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:07:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.203.84.97", "classifications": [], "first_seen": { "$date": "2023-01-30T05:09:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:10:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 59" ], "sightings": 41, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.208.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:09:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:19:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 26", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16081, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.42.130", "classifications": [], "first_seen": { "$date": "2023-01-30T05:09:45Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:26:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "137.74.36.230", "classifications": [], "first_seen": { "$date": "2023-01-30T05:09:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:54:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.73.147.154", "classifications": [], "first_seen": { "$date": "2023-01-30T05:10:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:20:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 90" ], "sightings": 37, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "164.92.112.145", "classifications": [], "first_seen": { "$date": "2023-01-30T05:11:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:18:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 67" ], "sightings": 8, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "178.128.185.78", "classifications": [], "first_seen": { "$date": "2023-01-30T05:12:05Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:12:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 83" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.248.92.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:12:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:02:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 111453, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.71.67.19", "classifications": [], "first_seen": { "$date": "2023-01-30T05:14:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:14:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 33" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "149.202.31.202", "classifications": [], "first_seen": { "$date": "2023-01-30T05:14:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:32:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "164.92.177.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:25:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 68", "ET 3CORESec Poor Reputation IP group 17", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.134.178.190", "classifications": [], "first_seen": { "$date": "2023-01-30T05:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:15:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.92.101.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T05:15:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:28:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 9", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28420, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.156.21.70", "classifications": [], "first_seen": { "$date": "2023-01-30T05:21:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:42:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "163.177.9.238", "classifications": [], "first_seen": { "$date": "2023-01-30T05:23:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T05:50:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 24, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.120.220", "classifications": [], "first_seen": { "$date": "2023-01-30T06:00:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:00:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 49" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.107.248.46", "classifications": [], "first_seen": { "$date": "2023-01-30T06:23:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T06:23:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.135.177.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T06:38:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:31:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 875, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "177.81.212.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T06:45:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:49:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10647, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.179.57.195", "classifications": [], "first_seen": { "$date": "2023-01-30T07:28:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:40:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 5" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.203.72.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:28:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:53:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 59", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29856, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.52.12.151", "classifications": [], "first_seen": { "$date": "2023-01-30T07:29:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:29:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 178" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.142.125.10", "classifications": [], "first_seen": { "$date": "2023-01-30T07:50:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:03:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 237, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "114.32.231.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:54:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:32:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10255, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.26.120.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T07:54:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:22:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 57", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2677, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "39.91.166.193", "classifications": [], "first_seen": { "$date": "2023-01-30T07:56:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T07:59:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 11, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "23.94.216.243", "classifications": [], "first_seen": { "$date": "2023-01-30T07:59:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:34:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 13", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS" ], "sightings": 7, "tags": [ "alert", "tcp", "ssh", "anomaly", "http" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "92.46.108.20", "classifications": [], "first_seen": { "$date": "2023-01-30T08:20:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:49:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 46" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "141.94.17.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T08:38:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:40:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 41", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16210, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.172.218.217", "classifications": [], "first_seen": { "$date": "2023-01-30T08:38:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:34:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 13", "ET SCAN Potential SSH Scan" ], "sightings": 41, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "185.46.18.99", "classifications": [], "first_seen": { "$date": "2023-01-30T08:38:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:29:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 4701, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.158.23.210", "classifications": [], "first_seen": { "$date": "2023-01-30T08:39:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:53:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "147.135.118.103", "classifications": [], "first_seen": { "$date": "2023-01-30T08:39:32Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:54:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.236.78.19", "classifications": [], "first_seen": { "$date": "2023-01-30T08:39:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:40:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "106.51.76.221", "classifications": [], "first_seen": { "$date": "2023-01-30T08:41:12Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:35:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 13" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.187.169.16", "classifications": [], "first_seen": { "$date": "2023-01-30T08:48:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T08:53:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 76, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "118.34.33.31", "classifications": [], "first_seen": { "$date": "2023-01-30T09:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.1.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:47:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:46:21Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 199915, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.190.52.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:47:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:26:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41047, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.143.233", "classifications": [], "first_seen": { "$date": "2023-01-30T09:51:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:52:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 44" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.134.150.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T09:51:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:58:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 24", "ET 3CORESec Poor Reputation IP group 10", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77307, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "191.55.237.65", "classifications": [], "first_seen": { "$date": "2023-01-30T09:52:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T09:52:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "81.68.184.4", "classifications": [], "first_seen": { "$date": "2023-01-30T10:16:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:16:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.5" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "223.219.193.24", "classifications": [], "first_seen": { "$date": "2023-01-30T10:42:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:42:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "58.229.6.213", "classifications": [], "first_seen": { "$date": "2023-01-30T10:49:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:52:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 169", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "89.215.210.114", "classifications": [], "first_seen": { "$date": "2023-01-30T10:58:36Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:01:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 185", "ET SCAN Potential SSH Scan" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "212.12.31.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:57:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30300, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "106.215.80.78", "classifications": [], "first_seen": { "$date": "2023-01-30T10:59:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:13:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "36.94.95.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T10:59:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T06:34:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 140", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 35, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "34.78.185.36", "classifications": [], "first_seen": { "$date": "2023-01-30T10:59:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T10:59:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 138" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "203.135.20.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T11:00:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:23:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4195, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.62.17.94", "classifications": [], "first_seen": { "$date": "2023-01-30T11:00:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:00:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 85", "ET SCAN Potential SSH Scan" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "115.166.142.18", "classifications": [], "first_seen": { "$date": "2023-01-30T11:00:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:11:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17", "ET 3CORESec Poor Reputation IP group 6" ], "sightings": 35, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "139.59.189.130", "classifications": [], "first_seen": { "$date": "2023-01-30T11:00:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:00:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 38", "ET SCAN Potential SSH Scan" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "165.154.231.2", "classifications": [], "first_seen": { "$date": "2023-01-30T11:01:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:10:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69" ], "sightings": 31, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.154.229.163", "classifications": [], "first_seen": { "$date": "2023-01-30T11:01:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:01:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.110.240.169", "classifications": [], "first_seen": { "$date": "2023-01-30T11:01:57Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:02:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "OpenSSH-keyscan", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "20.213.12.178", "classifications": [], "first_seen": { "$date": "2023-01-30T11:02:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:16:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "66.94.110.244", "classifications": [], "first_seen": { "$date": "2023-01-30T11:02:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:13:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.59.24.91", "classifications": [], "first_seen": { "$date": "2023-01-30T11:15:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:15:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "122.116.119.163", "classifications": [], "first_seen": { "$date": "2023-01-30T11:39:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:39:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 8" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.71.21.172", "classifications": [], "first_seen": { "$date": "2023-01-30T11:42:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T11:54:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 31, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "45.116.112.19", "classifications": [], "first_seen": { "$date": "2023-01-30T12:02:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:12:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 155" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.130.62.91", "classifications": [], "first_seen": { "$date": "2023-01-30T12:06:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:06:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 145" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.161.31.215", "classifications": [], "first_seen": { "$date": "2023-01-30T12:14:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:14:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.71.25.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:19:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 75", "ET 3CORESec Poor Reputation IP group 17", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "14.138.60.55", "classifications": [], "first_seen": { "$date": "2023-01-30T12:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T12:47:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 6" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "146.185.156.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T12:58:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:32:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 48", "ET 3CORESec Poor Reputation IP group 14", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62099, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "41.190.51.10", "classifications": [], "first_seen": { "$date": "2023-01-30T13:00:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:57:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 143", "ET 3CORESec Poor Reputation IP group 34" ], "sightings": 22147, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "164.92.161.202", "classifications": [], "first_seen": { "$date": "2023-01-30T13:04:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:37:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 68" ], "sightings": 253, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "52.172.168.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:05:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:19:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 167", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 83362, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.43.90", "classifications": [], "first_seen": { "$date": "2023-01-30T13:06:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:06:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.116.12.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:07:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:20:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 114", "ET 3CORESec Poor Reputation IP group 26", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10347, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "201.99.120.13", "classifications": [], "first_seen": { "$date": "2023-01-30T13:07:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:07:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 116" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.195.146.178", "classifications": [], "first_seen": { "$date": "2023-01-30T13:08:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:08:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "173.165.93.237", "classifications": [], "first_seen": { "$date": "2023-01-30T13:09:51Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:09:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "146.190.226.236", "classifications": [], "first_seen": { "$date": "2023-01-30T13:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:14:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 57, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "43.156.4.180", "classifications": [], "first_seen": { "$date": "2023-01-30T13:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:31:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.143.83.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:22:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:39:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8649, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.59.231", "classifications": [], "first_seen": { "$date": "2023-01-30T13:24:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:24:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "222.99.27.132", "classifications": [], "first_seen": { "$date": "2023-01-30T13:30:21Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T13:30:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "174.138.24.225", "classifications": [], "first_seen": { "$date": "2023-01-30T13:34:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:32:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 80" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.163.197.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T13:35:32Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:19:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 155", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 659, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "174.138.95.43", "classifications": [], "first_seen": { "$date": "2023-01-30T13:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:20:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 20, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.183.105.14", "classifications": [], "first_seen": { "$date": "2023-01-30T13:38:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:53:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174", "ET SCAN Potential SSH Scan" ], "sightings": 3372, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "223.205.209.8", "classifications": [], "first_seen": { "$date": "2023-01-30T14:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:37:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "78.189.54.141", "classifications": [], "first_seen": { "$date": "2023-01-30T14:41:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:41:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 77" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.35.146.188", "classifications": [], "first_seen": { "$date": "2023-01-30T14:49:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:49:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.229.130.18", "classifications": [], "first_seen": { "$date": "2023-01-30T14:53:04Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T14:53:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.55.82.234", "classifications": [], "first_seen": { "$date": "2023-01-30T15:22:15Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:22:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 36" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "221.213.129.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:23:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:16:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.70.190.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:44:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T20:52:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 173", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "187.55.24.33", "classifications": [], "first_seen": { "$date": "2023-01-30T15:44:56Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:02:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "197.5.145.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T15:46:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:20:21Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 110", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 91657, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.86.87.91", "classifications": [], "first_seen": { "$date": "2023-01-30T15:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:02:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "119.202.159.77", "classifications": [], "first_seen": { "$date": "2023-01-30T15:47:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T15:47:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "210.10.200.186", "classifications": [], "first_seen": { "$date": "2023-01-30T15:49:26Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:53:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 125" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.94.200.11", "classifications": [], "first_seen": { "$date": "2023-01-30T16:08:06Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:08:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "90.177.60.75", "classifications": [], "first_seen": { "$date": "2023-01-30T16:36:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:56:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "123.30.157.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:22:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 23", "ET 3CORESec Poor Reputation IP group 9", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6801, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.153.41.119", "classifications": [], "first_seen": { "$date": "2023-01-30T16:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:37:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 150" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "3.209.10.109", "classifications": [], "first_seen": { "$date": "2023-01-30T16:38:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:36:27Z" }, "ports": [ 40970, 51134, 50768, 54764 ], "reporting_nodes": 1, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management" ], "sightings": 3832, "tags": [ "alert", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.154.236.22", "classifications": [], "first_seen": { "$date": "2023-01-30T16:39:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:46:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69" ], "sightings": 37, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "75.185.192.176", "classifications": [], "first_seen": { "$date": "2023-01-30T16:39:17Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:53:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "170.106.114.160", "classifications": [], "first_seen": { "$date": "2023-01-30T16:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:39:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 78" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.131.54.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T16:39:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:37:42Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146", "ET 3CORESec Poor Reputation IP group 35", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57983, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "47.176.104.76", "classifications": [], "first_seen": { "$date": "2023-01-30T16:40:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:27:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 161" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.198.161.95", "classifications": [], "first_seen": { "$date": "2023-01-30T16:40:27Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T16:40:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 45" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "92.81.222.217", "classifications": [], "first_seen": { "$date": "2023-01-30T16:40:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:51:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187" ], "sightings": 41, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.222.13.180", "classifications": [], "first_seen": { "$date": "2023-01-30T16:41:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:29:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 164", "ET 3CORESec Poor Reputation IP group 38", "ET SCAN Potential SSH Scan" ], "sightings": 106, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "64.62.197.4", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-01-30T16:52:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:01:13Z" }, "ports": [ 80, 0, 161 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 5621, "tags": [ "alert", "tcp", "http", "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "211.225.41.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T17:39:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:43:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5349, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.209.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T17:48:00Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T03:51:49Z" }, "ports": [ 22, 5060, 0 ], "reporting_nodes": 3, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15663, "tags": [ "alert", "tcp", "ssh", "Go", "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "128.199.219.215", "classifications": [], "first_seen": { "$date": "2023-01-30T17:50:20Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:05:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.153.44.237", "classifications": [], "first_seen": { "$date": "2023-01-30T17:58:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:58:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 150" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.227.72.154", "classifications": [], "first_seen": { "$date": "2023-01-30T17:58:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:56:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 173", "ET SCAN Potential SSH Scan" ], "sightings": 41, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "176.10.207.140", "classifications": [], "first_seen": { "$date": "2023-01-30T17:59:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T01:57:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81", "ET SCAN Potential SSH Scan" ], "sightings": 677, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "165.232.64.113", "classifications": [], "first_seen": { "$date": "2023-01-30T17:59:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T17:59:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 73" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.244.141.128", "classifications": [], "first_seen": { "$date": "2023-01-30T17:59:30Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:01:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 46", "ET SCAN Potential SSH Scan" ], "sightings": 46, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "177.207.90.0", "classifications": [], "first_seen": { "$date": "2023-01-30T18:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:14:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.164.221.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:00:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:37:57Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 4", "ET 3CORESec Poor Reputation IP group 1", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43238, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "164.92.87.79", "classifications": [], "first_seen": { "$date": "2023-01-30T18:00:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:00:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.115.207.244", "classifications": [], "first_seen": { "$date": "2023-01-30T18:01:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:01:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 87" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.208.137.90", "classifications": [], "first_seen": { "$date": "2023-01-30T18:01:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:00:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 6" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.130.7.52", "classifications": [], "first_seen": { "$date": "2023-01-30T18:01:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:01:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 145", "ET 3CORESec Poor Reputation IP group 35" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "23.224.102.207", "classifications": [], "first_seen": { "$date": "2023-01-30T18:02:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:15:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 133" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "41.42.209.81", "classifications": [], "first_seen": { "$date": "2023-01-30T18:02:10Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:01:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 19, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "34.100.239.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:06:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:56:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 137", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18909, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.211.72.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:06:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:25:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.67.47.86", "classifications": [], "first_seen": { "$date": "2023-01-30T18:06:40Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:23:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.240.35.163", "classifications": [], "first_seen": { "$date": "2023-01-30T18:07:00Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:52:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 11, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "113.23.19.43", "classifications": [], "first_seen": { "$date": "2023-01-30T18:08:50Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:09:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "1.34.18.197", "classifications": [], "first_seen": { "$date": "2023-01-30T18:15:31Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:15:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 3" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.61.8.34", "classifications": [], "first_seen": { "$date": "2023-01-30T18:16:01Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:17:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "31.53.192.76", "classifications": [], "first_seen": { "$date": "2023-01-30T18:28:11Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:28:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.22.240.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:50:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:22:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 71", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16350, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.150.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:19:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 56622, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "5.150.254.239", "classifications": [], "first_seen": { "$date": "2023-01-30T18:51:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:51:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 164" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.163.125.104", "classifications": [], "first_seen": { "$date": "2023-01-30T18:51:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T18:51:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.172.117.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:52:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:51:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 74", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48901, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.51.74.25", "classifications": [], "first_seen": { "$date": "2023-01-30T18:53:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:47:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 14, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.99.152.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:53:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:24:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 76", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 143, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "65.109.211.81", "classifications": [], "first_seen": { "$date": "2023-01-30T18:54:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:15:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.129.29.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:54:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:37:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 179", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 282, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "118.128.237.197", "classifications": [], "first_seen": { "$date": "2023-01-30T18:54:02Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:07:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "142.93.163.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:54:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:37:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.155.181.25", "classifications": [], "first_seen": { "$date": "2023-01-30T18:55:42Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:11:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "112.221.4.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:55:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:55:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 40273, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "199.120.72.166", "classifications": [], "first_seen": { "$date": "2023-01-30T18:55:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:46:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 508, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "197.199.224.52", "classifications": [], "first_seen": { "$date": "2023-01-30T18:56:22Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:56:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 109" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.253.45.26", "classifications": [], "first_seen": { "$date": "2023-01-30T18:57:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:11:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "92.27.157.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T18:57:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:46:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187", "ET 3CORESec Poor Reputation IP group 46", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6236, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "1.54.107.86", "classifications": [], "first_seen": { "$date": "2023-01-30T19:05:52Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:05:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "91.240.118.77", "classifications": [], "first_seen": { "$date": "2023-01-30T19:14:03Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:14:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 87" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "82.55.22.118", "classifications": [], "first_seen": { "$date": "2023-01-30T19:31:13Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:31:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "101.187.75.76", "classifications": [], "first_seen": { "$date": "2023-01-30T19:39:23Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T19:39:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "51.250.13.75", "classifications": [], "first_seen": { "$date": "2023-01-30T19:54:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:13:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 11, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.94.168.42", "classifications": [], "first_seen": { "$date": "2023-01-30T19:55:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:32:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 9", "ET SCAN Potential SSH Scan" ], "sightings": 13263, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.189.127.73", "classifications": [], "first_seen": { "$date": "2023-01-30T20:11:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:11:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "218.60.95.59", "classifications": [], "first_seen": { "$date": "2023-01-30T20:13:44Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:18:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh", "anomaly", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "213.6.203.226", "classifications": [], "first_seen": { "$date": "2023-01-30T20:14:34Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:31:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 129" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.213.17.47", "classifications": [], "first_seen": { "$date": "2023-01-30T20:14:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:14:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 181" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.142.26.113", "classifications": [], "first_seen": { "$date": "2023-01-30T20:15:24Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:15:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.154.233.238", "classifications": [], "first_seen": { "$date": "2023-01-30T20:15:54Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:15:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.154.253.141", "classifications": [], "first_seen": { "$date": "2023-01-30T20:16:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:18:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 70", "ET SCAN Potential SSH Scan" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "216.172.165.97", "classifications": [], "first_seen": { "$date": "2023-01-30T20:18:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T18:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 130" ], "sightings": 17, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "119.110.254.249", "classifications": [], "first_seen": { "$date": "2023-01-30T20:41:55Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:41:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.25.189.150", "classifications": [], "first_seen": { "$date": "2023-01-30T20:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:45:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.106.218.57", "classifications": [], "first_seen": { "$date": "2023-01-30T20:50:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:50:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "20.194.105.28", "classifications": [], "first_seen": { "$date": "2023-01-30T20:52:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:55:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 116" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "1.170.121.64", "classifications": [], "first_seen": { "$date": "2023-01-30T20:55:16Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T20:55:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.232.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-01-30T21:03:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:18:00Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3090, "tags": [ "alert", "tcp", "ssh", "anomaly", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "85.105.98.56", "classifications": [], "first_seen": { "$date": "2023-01-30T21:14:46Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:14:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.235.24.33", "classifications": [ "Information Leak", "Misc activity", "Executable code was detected", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-01-30T21:41:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:04:41Z" }, "ports": [ 22, 0, 53, 1900, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-DNS named version attempt", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 54432, "tags": [ "ssh", "tcp", "ssh", "ZGrab", "ssh", "icmp", "udp", "snmp" ], "rule_count": 10, "classification_count": 5 }, { "ioc": "43.159.45.13", "classifications": [], "first_seen": { "$date": "2023-01-30T21:49:07Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:06:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.223.102.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T21:49:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:55:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 59", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 360, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.59.101.141", "classifications": [], "first_seen": { "$date": "2023-01-30T21:50:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:50:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 37" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.227.178.106", "classifications": [], "first_seen": { "$date": "2023-01-30T21:52:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:52:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 172" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.2.135.19", "classifications": [], "first_seen": { "$date": "2023-01-30T21:52:47Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:52:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 6" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.73.128.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T21:54:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:57:11Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 113", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12389, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.217", "classifications": [], "first_seen": { "$date": "2023-01-30T21:56:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T21:56:08Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 1, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.34.80.32", "classifications": [], "first_seen": { "$date": "2023-01-30T21:58:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:00:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan" ], "sightings": 73, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "184.170.210.30", "classifications": [], "first_seen": { "$date": "2023-01-30T21:59:08Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:11:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "110.172.191.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T21:59:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:58:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 15", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1918, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.218.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:00:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:19:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 141320, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.93.204.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:01:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:05:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 138", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 9921, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "34.69.39.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:01:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 138", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 5357, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "183.88.244.176", "classifications": [], "first_seen": { "$date": "2023-01-30T22:01:48Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:55:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 91" ], "sightings": 32, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.134.170.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:03:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:51:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35835, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.90.199.18", "classifications": [], "first_seen": { "$date": "2023-01-30T22:03:28Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:55:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 119" ], "sightings": 32, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.115.145.34", "classifications": [], "first_seen": { "$date": "2023-01-30T22:05:38Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:05:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 87" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.187.229.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:07:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:47:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1291, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.46.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:19:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:17:46Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62440, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.70.85.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:19:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:22:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 107", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.135.157.133", "classifications": [], "first_seen": { "$date": "2023-01-30T22:20:18Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:36:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "191.37.245.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-01-30T22:22:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:06:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4332, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.240.138.240", "classifications": [], "first_seen": { "$date": "2023-01-30T22:23:19Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:38:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "171.227.222.34", "classifications": [], "first_seen": { "$date": "2023-01-30T22:33:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:33:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "108.64.193.106", "classifications": [], "first_seen": { "$date": "2023-01-30T22:35:29Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:35:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 3" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "123.30.149.76", "classifications": [], "first_seen": { "$date": "2023-01-30T22:37:49Z" }, "ja3": [], "last_seen": { "$date": "2023-01-30T22:55:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 23" ], "sightings": 18, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.39.224.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:12:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:12:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.92.246.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:13:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:28:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 7992, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.126.166.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:16:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:16:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.134.104.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:16:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:17:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.143.23", "classifications": [ "Attempted Information Leak", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-03T17:27:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:47:43Z" }, "ports": [ 161, 0, 111 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 2767, "tags": [ "udp", "snmp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "192.241.200.47", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:27:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:27:59Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "202.163.121.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:29:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:53:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 107384, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.59.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:29:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:17:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.67.216.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:30:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:14:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.141.49.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:31:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:05:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 202450, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.29.236.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:34:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:37:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21888, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.170.60.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:37:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:53:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.48.187.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:38:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:53:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.58.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:39:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:52:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.48.103.22", "classifications": [], "first_seen": { "$date": "2023-03-03T17:42:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:42:04Z" }, "ports": [ 8083 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.235.24.184", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-03T17:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:19:24Z" }, "ports": [ 0, 53, 5632, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "APP-DETECT PCAnywhere server response", "SQL ping attempt" ], "sightings": 31366, "tags": [ "icmp", "udp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "109.206.240.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:55:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 499676, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:53:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:49:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2782, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:55:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:10:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "168.138.183.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T17:56:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:26:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8352, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.210.158.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:02:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:15:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.252.25.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:18:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 106951, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "3.83.111.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T18:03:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:46:08Z" }, "ports": [ 50951, 59184, 0, 50521, 54393 ], "reporting_nodes": 2, "rules": [ "(port_scan) UDP filtered portsweep", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) UDP portsweep" ], "sightings": 1389631, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "195.222.163.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:11:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.44.240.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:05:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:04:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19961, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.198.9.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:07:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:07:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.70.180.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:08:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:17:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60008, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.103.240.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:08:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:04:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5984, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.32", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-03T18:09:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:03:34Z" }, "ports": [ 0, 161, 53, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt", "SQL ping attempt" ], "sightings": 50146, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "89.248.163.165", "classifications": [], "first_seen": { "$date": "2023-03-03T18:09:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:37:43Z" }, "ports": [ 60624, 61215, 61631 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 6302, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.163.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:11:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:23:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.163.207.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:12:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:21:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.139.87.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T18:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:18:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 14101, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.83.200.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:16:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:30:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.248.133.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T18:20:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:58:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3320, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.231.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T18:42:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:30:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 235658, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.239.16", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-03T18:45:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:18:24Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 2437, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "152.32.180.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T18:48:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:48:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T18:50:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:24:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 103165, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.246.130.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T18:52:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:07:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 57997, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.159.37.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:55:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:56:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.102.38.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:58:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:13:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.145.127.42", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-03T19:01:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:03:49Z" }, "ports": [ 1900, 0, 53 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 21138, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "159.203.81.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:03:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:23:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.210.21.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:06:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:20:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.235.3.122", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:06:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:41:09Z" }, "ports": [ 65476, 0, 5060 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38462, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.156.2.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:06:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:23:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.167.222.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:08:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:47:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 213610, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.230.163.186", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:11:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:34:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 135946, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "18.234.149.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:11:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:39:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 169960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.227.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:13:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:13:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.92.100.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:13:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:13:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.115.199.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:18:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:18:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56581, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.131.66.209", "classifications": [ "Misc activity", "Potentially Bad Traffic", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-03T19:22:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:20:07Z" }, "ports": [ 0, 69, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP Get", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 81341, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "131.159.24.205", "classifications": [], "first_seen": { "$date": "2023-03-03T19:23:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:51:29Z" }, "ports": [ 443, 80 ], "reporting_nodes": 2, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 13857, "tags": [ "tcp", "https", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "38.9.140.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:26:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:42:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8364, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.159.70.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:30:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:30:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:33:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:22:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2550, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.213.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:34:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:12:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 385262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.136", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-03T19:35:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:19:17Z" }, "ports": [ 0, 80, 53 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt" ], "sightings": 6616, "tags": [ "icmp", "alert", "tcp", "http", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.35.18.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T19:36:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:23:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41921, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.65.144.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:36:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:52:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.115.96.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:37:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:17:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19561, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "60.248.95.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:38:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:54:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.79.1.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:38:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:50:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "80.91.167.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:38:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:21:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.28.201.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:39:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:30:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 112749, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.248.12.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:43:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:39:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1608, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.212.235.219", "classifications": [], "first_seen": { "$date": "2023-03-03T19:44:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:44:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "104.29.50.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:57:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:38:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.144.48.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:00:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:44:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19906, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.91.238.4", "classifications": [], "first_seen": { "$date": "2023-03-03T17:13:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:13:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "HELLOWORLD", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "143.110.182.22", "classifications": [], "first_seen": { "$date": "2023-03-03T17:14:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:40:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1110, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.172.201.220", "classifications": [], "first_seen": { "$date": "2023-03-03T17:15:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:51:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 13", "ET SCAN Potential SSH Scan" ], "sightings": 3065, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "40.115.199.211", "classifications": [], "first_seen": { "$date": "2023-03-03T17:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:24:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "72.21.217.87", "classifications": [], "first_seen": { "$date": "2023-03-03T17:20:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:20:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "72.21.217.41", "classifications": [], "first_seen": { "$date": "2023-03-03T17:20:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T17:21:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "libssh2_1.9.0-20210611", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "190.217.69.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:25:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:47:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 103", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24958, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.38.36.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:52:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:51:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 164", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 64093, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "34.92.176.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:53:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:22:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 138", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9528, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.178.155.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T17:58:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:43:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 167", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 86583, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.156.84.114", "classifications": [], "first_seen": { "$date": "2023-03-03T18:00:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:56:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 23, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.227.68.95", "classifications": [], "first_seen": { "$date": "2023-03-03T18:00:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:51:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 72", "ET SCAN Potential SSH Scan" ], "sightings": 49, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.168.205.250", "classifications": [], "first_seen": { "$date": "2023-03-03T18:00:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:18:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.153.22.141", "classifications": [], "first_seen": { "$date": "2023-03-03T18:01:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:33:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1180, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.157.21.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:02:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:57:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 154", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9460, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.177.232.0", "classifications": [], "first_seen": { "$date": "2023-03-03T18:03:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:50:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "137.184.225.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:03:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T14:08:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31936, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "211.168.74.7", "classifications": [], "first_seen": { "$date": "2023-03-03T18:11:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:11:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.37.83.54", "classifications": [], "first_seen": { "$date": "2023-03-03T18:22:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:22:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.153.72.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:24:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:01:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 151", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47194, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.94.218.57", "classifications": [], "first_seen": { "$date": "2023-03-03T18:28:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:15:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 20, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.172.175", "classifications": [], "first_seen": { "$date": "2023-03-03T18:28:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T18:28:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.155.222.184", "classifications": [], "first_seen": { "$date": "2023-03-03T18:31:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:35:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 37060, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "38.54.119.47", "classifications": [], "first_seen": { "$date": "2023-03-03T18:54:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:53:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 14, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "77.94.113.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:54:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:14:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40305, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "150.230.205.189", "classifications": [], "first_seen": { "$date": "2023-03-03T18:54:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:16:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1967, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "129.226.198.167", "classifications": [], "first_seen": { "$date": "2023-03-03T18:54:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:50:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 22, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "163.177.9.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T18:55:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T02:37:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 117896, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "202.29.229.129", "classifications": [], "first_seen": { "$date": "2023-03-03T18:56:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:54:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 11, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.205.122.4", "classifications": [], "first_seen": { "$date": "2023-03-03T18:57:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:53:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 153, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "99.130.111.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:00:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:02:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 47", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18021, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.22.198", "classifications": [], "first_seen": { "$date": "2023-03-03T19:02:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:47:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 149", "ET SCAN Potential SSH Scan" ], "sightings": 255, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "83.194.71.173", "classifications": [], "first_seen": { "$date": "2023-03-03T19:02:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:07:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 67, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "38.54.87.28", "classifications": [], "first_seen": { "$date": "2023-03-03T19:09:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:06:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 664, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "115.71.239.208", "classifications": [], "first_seen": { "$date": "2023-03-03T19:10:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:34:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "148.66.132.190", "classifications": [], "first_seen": { "$date": "2023-03-03T19:33:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:11:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 50", "ET SCAN Potential SSH Scan" ], "sightings": 12663, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "107.173.209.231", "classifications": [], "first_seen": { "$date": "2023-03-03T19:35:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:47:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "195.211.46.197", "classifications": [], "first_seen": { "$date": "2023-03-03T19:36:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:36:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 108" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.252.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:41:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:39:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 15", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1177, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.183.192.14", "classifications": [], "first_seen": { "$date": "2023-03-03T19:42:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:42:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.249.176.178", "classifications": [], "first_seen": { "$date": "2023-03-03T19:44:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:44:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 115" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.52.114.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:46:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:32:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24292, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.156.238.54", "classifications": [], "first_seen": { "$date": "2023-03-03T19:47:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:23:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 87, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.183.75.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T19:49:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:03:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 5", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45748, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "35.224.42.65", "classifications": [], "first_seen": { "$date": "2023-03-03T19:50:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:38:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139", "ET SCAN Potential SSH Scan" ], "sightings": 32434, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "189.101.167.185", "classifications": [], "first_seen": { "$date": "2023-03-03T19:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T19:53:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "51.77.245.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T20:05:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:28:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.247.34.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:08:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:19:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49444, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.200.118.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T20:12:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:06:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 261876, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.194.117.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:13:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:13:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14166, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.102.36.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:09:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:03:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24569, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.80.179.118", "classifications": [], "first_seen": { "$date": "2023-03-03T20:13:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:45:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 171", "ET SCAN Potential SSH Scan" ], "sightings": 11075, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "95.165.138.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:24:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:09:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 210597, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.153.57", "classifications": [], "first_seen": { "$date": "2023-03-03T20:15:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:19:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 20832, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "202.56.232.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:31:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:18:52Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 26" ], "sightings": 11841, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.186.86.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:33:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:47:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63351, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.102.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:33:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T20:45:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49347, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.59.219.36", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-03T20:35:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:32:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 116964, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "199.195.249.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T20:36:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:34:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 53901, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T20:47:52Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:21:58Z" }, "ports": [ 5632, 0 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23990, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.217.207.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:48:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:02:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16" ], "sightings": 56764, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.34", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-03-03T20:50:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:19:23Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 483955, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "51.158.150.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T20:50:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:06:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 136129, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.47.252.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T20:57:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:51:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17069, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.114.93.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:08:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:09:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14105, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.106.39.58", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-03T21:14:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:02:42Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 872606, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "151.106.38.138", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-03T21:16:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:09:01Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 888368, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "195.154.77.190", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-03-03T21:21:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:51:23Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37655, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "173.20.50.232", "classifications": [], "first_seen": { "$date": "2023-03-03T21:16:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:16:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 645, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.36.193.82", "classifications": [], "first_seen": { "$date": "2023-03-03T21:21:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:36:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA STREAM FIN1 FIN with wrong seq" ], "sightings": 60612, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 7, "classification_count": 0 }, { "ioc": "187.123.56.57", "classifications": [], "first_seen": { "$date": "2023-03-03T21:28:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:11:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 96", "ET 3CORESec Poor Reputation IP group 23" ], "sightings": 23102, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "167.99.156.118", "classifications": [], "first_seen": { "$date": "2023-03-03T21:29:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:17:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 76", "ET SCAN Potential SSH Scan" ], "sightings": 32084, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "152.32.168.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T21:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14101, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T21:35:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:59:14Z" }, "ports": [ 5632, 0 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24488, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "38.132.109.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T21:35:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:00:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28142, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.65.239.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:37:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:07:59Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9194, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.104.188.110", "classifications": [], "first_seen": { "$date": "2023-03-03T21:39:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T21:42:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 43081, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "5.178.3.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:49:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:03:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56169, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.155.158.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:50:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:07:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 70172, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "81.218.183.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:50:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:05:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14993, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.192.21", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-03T21:50:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:07:48Z" }, "ports": [ 162, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37407, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "36.67.40.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:52:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:33:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 224478, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.179.225.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:53:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:24:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 331251, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.88.188.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:53:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:05:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63165, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.219.241.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:54:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:04:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 118834, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.25.112.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T21:58:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:47:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14073, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.192.240.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T22:08:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:13:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19874, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.137.245.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T22:10:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:10:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14038, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.34.76.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T22:14:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:15:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14039, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.61", "classifications": [], "first_seen": { "$date": "2023-03-03T22:08:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:08:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1280, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.79.145.66", "classifications": [], "first_seen": { "$date": "2023-03-03T22:11:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:04:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 14678, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "1.34.159.113", "classifications": [], "first_seen": { "$date": "2023-03-03T22:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:14:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 820, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.159.91.192", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-03-03T22:24:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:11:53Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 257572, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "139.59.80.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T22:34:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:39:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77307, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.136.225.31", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic", "Detection of a Network Scan", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-03T22:34:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:58:17Z" }, "ports": [ 1434, 0, 161, 162, 69, 177, 53, 1900, 111 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP trap udp", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP Get", "X11 xdmcp info query", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 908684, "tags": [ "udp", "icmp", "snmp", "snmptrap", "tftp", "xdmcp", "sunrpc", "portmapper" ], "rule_count": 12, "classification_count": 5 }, { "ioc": "198.46.215.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T22:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:27:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 208089, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.107.2.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T22:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:51:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18707, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.230.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T22:43:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:16:19Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 14092, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.211.36.209", "classifications": [], "first_seen": { "$date": "2023-03-03T22:32:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:37:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 48488, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "63.42.209.67", "classifications": [], "first_seen": { "$date": "2023-03-03T22:44:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:46:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 45898, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "119.36.17.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T22:45:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:14:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.76.221.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T22:45:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:09:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 55866, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.31.159.76", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-03T22:51:00Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:15:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 57005, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.55.0.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T22:54:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:54:28Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 17872, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "93.87.143.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T22:55:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:55:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13966, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.36.81.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T22:57:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T22:57:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13960, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.188.87.2", "classifications": [], "first_seen": { "$date": "2023-03-03T22:58:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:42:53Z" }, "ports": [ 32626, 32314, 36266, 35434, 38866, 42090, 41050 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 26113, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "41.209.43.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T23:08:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:33:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55646, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.181.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T23:11:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:23:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 69378, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.125.242.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T23:20:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:33:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 21241, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T23:23:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:23:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13929, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "15.188.14.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T23:27:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:15:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 42614, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.232.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T23:32:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:39:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 216103, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T23:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:29:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13962, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.51.200.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T23:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:41:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20873, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.172", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-03T23:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:01:15Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 23516, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "123.193.145.198", "classifications": [], "first_seen": { "$date": "2023-03-03T23:33:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:33:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1268, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "109.248.212.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T23:42:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:37:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 15", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21837, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.210.211.114", "classifications": [], "first_seen": { "$date": "2023-03-03T23:45:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 33", "ET SCAN Potential SSH Scan" ], "sightings": 682, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "13.81.240.106", "classifications": [], "first_seen": { "$date": "2023-03-03T23:45:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:00:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35" ], "sightings": 12022, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.238.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T23:47:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T20:19:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16456, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.233.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-03T23:48:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:00:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22458, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.178.161.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T23:50:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:07:14Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77110, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.127.253.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-03T23:52:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-03T23:52:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13902, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.216.254.180", "classifications": [], "first_seen": { "$date": "2023-03-03T23:46:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:36:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 13256, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.253.108.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T00:03:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:07:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 347428, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.210.217.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:06:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:14:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 253260, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.170.118.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T00:06:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:06:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13874, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.1.40.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:06:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13870, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.151.137.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:08:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13878, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.224.128.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:11:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:11:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13870, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.8.132.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:14:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:12:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25869, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.98.220.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:16:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:16:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13870, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.146.243.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:23:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:23:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13862, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.175", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T00:23:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:49:21Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 21760, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.147.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:36:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:05:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17791, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.201.44.206", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:37:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:29:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 64883, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.24.252.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T00:39:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:55:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62038, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "150.221.146.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:53:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27677, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.88.31.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:41:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:27:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25872, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.224.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:43:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:13:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14294, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.21.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T00:42:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:31:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11184, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:46:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:13:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29676, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.209.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T00:46:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:47:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13837, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.172", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-04T00:48:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:31:38Z" }, "ports": [ 0, 161, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-TFTP Get" ], "sightings": 27560, "tags": [ "icmp", "udp", "snmp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "36.158.216.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T00:48:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:20:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41642, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "60.210.40.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T00:50:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:00:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13670, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "78.99.176.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:54:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:54:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13844, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T00:57:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:42:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.67.139.34", "classifications": [], "first_seen": { "$date": "2023-03-04T00:50:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:09:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 87205, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "59.36.169.182", "classifications": [], "first_seen": { "$date": "2023-03-04T00:54:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T00:58:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1884, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.159.95.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:01:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:41:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 237327, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.96.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:02:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:42:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17048, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.204.13.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:08:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:08:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13836, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.157.84.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T01:10:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:17:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 338089, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "135.148.148.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T01:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:25:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68789, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.246.220.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:21:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:14:11Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 79683, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "68.32.52.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:25:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:34:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 93570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.32.43.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T01:26:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:26:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13811, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.169.39.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:26:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:39:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27609, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.165", "classifications": [ "Executable code was detected", "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T01:28:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:25:01Z" }, "ports": [ 22, 0, 161, 1434 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 19786, "tags": [ "tcp", "ssh", "icmp", "udp", "snmp" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "82.166.57.195", "classifications": [], "first_seen": { "$date": "2023-03-04T01:29:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:29:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 81", "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 1878, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.134.144.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:32:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:11:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 80261, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.239.25", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T01:34:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:29:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 13825, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.197.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:36:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:36:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13804, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.202.219.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:38:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:44:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22401, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.244.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:40:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:57:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38859, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.224.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:42:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:30:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21388, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.61", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:43:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:16:30Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41232, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "206.189.198.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T01:44:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:59:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 122", "ET SCAN Potential SSH Scan" ], "sightings": 69053, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "223.197.202.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T01:45:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:03:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68665, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.238.4", "classifications": [], "first_seen": { "$date": "2023-03-04T01:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:37:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1250, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "110.49.17.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T01:46:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:56:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 15" ], "sightings": 55091, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.129.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:47:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T12:51:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18225, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.6.223.149", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:47:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:47:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 34356, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.200.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:48:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:43:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13791, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.203.40.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:13:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27495, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.226.243.210", "classifications": [], "first_seen": { "$date": "2023-03-04T01:53:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:53:05Z" }, "ports": [ 81 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 13758, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "140.99.221.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:55:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:55:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.46.99.56", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:59:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:59:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 34274, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.189.11.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T01:59:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:09:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 51394, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.45.215.206", "classifications": [], "first_seen": { "$date": "2023-03-04T01:54:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T01:54:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 1248, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "80.200.34.0", "classifications": [], "first_seen": { "$date": "2023-03-04T02:01:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:01:26Z" }, "ports": [ 88 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 13751, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "67.231.28.131", "classifications": [], "first_seen": { "$date": "2023-03-04T02:03:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:23:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 97741, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "211.193.149.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:05:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:05:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13744, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.218.15", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T02:09:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:13:22Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 19094, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.206.72.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:10:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:23:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34270, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.248.72.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:11:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:11:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13738, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.134.5.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:11:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:11:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13740, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.213.208.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:27:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68378, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "44.207.111.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:12:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:49:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 204058, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.133.225.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:12:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:27:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 61556, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.39.189.39", "classifications": [], "first_seen": { "$date": "2023-03-04T02:05:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:54:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 136372, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "198.235.24.158", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T02:06:55Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:32:15Z" }, "ports": [ 22, 0, 1434, 161, 5632 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "APP-DETECT PCAnywhere server response" ], "sightings": 13981, "tags": [ "ssh", "tcp", "ssh", "ssh", "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "222.119.163.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:14:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:08:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9363, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.155.55.108", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:16:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:16:56Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20561, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "159.223.136.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:24:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:31:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18093, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.142.246", "classifications": [], "first_seen": { "$date": "2023-03-04T02:24:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:32:39Z" }, "ports": [ 3389, 4433, 8080, 58603, 8088, 7443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 16965, "tags": [ "tcp", "rdp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.157.233.106", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:29:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:39:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 97372, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.97.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:31:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:43:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16748, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.9", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-04T02:32:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:07:28Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 30354, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.18", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:32:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:13:08Z" }, "ports": [ 1900, 0, 161, 22, 1434 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SQL ping attempt" ], "sightings": 36101, "tags": [ "udp", "icmp", "snmp", "tcp", "ssh" ], "rule_count": 7, "classification_count": 4 }, { "ioc": "192.241.218.20", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T02:33:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:12:41Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 14948, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "168.138.181.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:33:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:55:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27028, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.32.172.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:36:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:36:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13681, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.31.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:36:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:37:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13679, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.237.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:42:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:42:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13675, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.81.144.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:44:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:44:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13674, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.77.4.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T02:49:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:49:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13667, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.250.10.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:50:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:11:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 607329, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.98.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T02:53:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:11:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31417, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.45", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T02:56:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:06:21Z" }, "ports": [ 0, 177 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 14753, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "204.15.78.240", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T02:56:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T02:57:54Z" }, "ports": [ 110, 554, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 20478, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.195.93.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:00:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:15:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44182, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "169.150.252.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 338778, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.58.246.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 338353, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.206.83.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 337964, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "138.199.4.6", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 337243, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.17.41.70", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 327410, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.17.59.160", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 330516, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "169.150.242.131", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 335893, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.245.214.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 337101, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "169.150.250.51", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:02:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 310584, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.93.1.70", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 333047, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.152.66.70", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 331172, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.59.221.193", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 334360, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "5.149.110.157", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 332918, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "179.49.23.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 330759, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.102.219.73", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 331503, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "131.72.209.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 331052, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.19.218.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 329725, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.102.218.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 314861, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "156.146.40.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 329133, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.187.162.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 330734, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.187.165.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 330172, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.187.164.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 330319, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.17.63.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 328482, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "156.146.52.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 328669, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.102.217.173", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 324851, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "138.199.57.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 329505, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.246.208.70", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 328391, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "156.146.53.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 329066, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.76.9.139", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 326640, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.59.223.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 325101, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.19.203.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 329315, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "169.150.202.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 326259, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.187.160.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 326879, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "195.181.162.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 324443, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "169.150.238.163", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 324922, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.93.2.218", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 320497, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "138.199.14.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 326760, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.180.12.51", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 327130, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.17.57.160", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 323596, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.93.3.53", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 325625, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.19.216.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 323335, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.255.175.36", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 323532, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "143.244.63.154", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 322648, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.83.241.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 309376, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.77.58.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 309290, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "169.150.228.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 316822, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "46.99.249.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 317547, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.243.80.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 316034, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.19.204.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 311141, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "138.124.157.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 317107, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.10.177.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 316488, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "196.203.103.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 315468, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "212.188.77.150", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 309865, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "49.231.121.48", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 314552, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.149.176.13", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 309854, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.5.20", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 311055, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.134.143.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 309049, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.73.117.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 307808, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "109.110.244.165", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 318826, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "86.51.22.81", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 306788, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.183.221.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 317944, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.39.176.9", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 307768, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.24.140.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 313778, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.152.65.117", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 309610, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "87.249.129.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 305023, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "123.253.8.6", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304369, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "165.98.72.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 302858, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.202.4.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 314316, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.24.128.13", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 299473, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "62.75.64.16", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 307204, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "189.204.190.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304317, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "88.85.121.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 306329, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.12.63.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 303374, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.61.111.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 305343, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.46.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 303330, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.206.153.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 305243, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "212.188.78.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 306386, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "94.73.1.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304009, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "154.81.51.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 302179, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.211.13.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 305791, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "180.211.202.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 305705, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "197.225.170.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304329, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.244.78.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304192, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "168.253.96.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304928, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "87.249.130.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:02:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 301854, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "212.199.147.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 305767, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.64.201.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:01:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 108037, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.197.8.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 300481, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.19.202.59", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304664, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.150.69.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 298842, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.19.208.33", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 302780, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "82.213.5.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304697, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "99.37.246.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:42:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 186142, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.237.149.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 301824, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "210.201.35.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 300442, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.2.150.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 298072, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "82.166.222.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304167, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.78.28.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 302080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.48.242.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 295492, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.189.84.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 301653, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "85.114.252.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 299726, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.239.236.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 303174, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.214.171.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 299036, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "128.75.238.212", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:01:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 107050, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "109.127.80.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304926, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "197.148.108.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 301388, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "195.250.92.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 300619, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "187.190.32.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 299623, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.239.127.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 300346, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.117.99.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 303501, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "182.48.75.231", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 301236, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "102.67.99.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 298281, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "31.146.250.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 294608, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "151.248.104.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297977, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "123.176.0.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 299317, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.236.187.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 296259, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.118.43.221", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297571, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "156.38.77.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 300178, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "94.128.5.228", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 298083, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.239.101.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 296673, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.61.119.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 305026, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.145.137.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297207, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.49.30.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 298600, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.29.52.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297157, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "151.248.104.106", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297875, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.46.18.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 298537, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.16.19.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297030, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "62.209.12.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 298931, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "202.87.130.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 294417, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.250.221.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297230, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.114.113.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 294009, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "217.69.180.101", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 293123, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "41.110.39.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 295948, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "102.163.31.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 298884, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.238.74.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 295459, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.14.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 295811, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.17.119.199", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 295190, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.176.198.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 296274, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "105.174.34.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 295638, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.106.106.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 296911, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.129.123.85", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 295338, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.41.57.245", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297503, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "41.209.83.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 303079, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.158.175.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 297695, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "202.173.121.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 296562, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.250.53.148", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 293973, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.160.226.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 292447, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "189.17.219.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 299524, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "212.34.31.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 293347, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "62.201.196.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 293495, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.101.0.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 292103, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "102.130.195.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 291691, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.186.147.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 292360, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "173.225.246.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:02:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 290828, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.19.206.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 291137, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "87.249.137.11", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:01:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 291016, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.28", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:01:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:32:46Z" }, "ports": [ 0, 53, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54205, "tags": [ "icmp", "udp", "tcp", "ssh" ], "rule_count": 7, "classification_count": 4 }, { "ioc": "185.152.67.56", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:02:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 291080, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "180.149.91.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:02:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 291459, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.253.78.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:02:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:02:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 290414, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "154.198.0.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:02:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:04:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 289707, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.124.31.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:02:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 304008, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.113.233.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:02:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 310250, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "179.6.174.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:02:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 307576, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "184.105.139.68", "classifications": [], "first_seen": { "$date": "2023-03-04T03:03:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:03:40Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 6238, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.104.21.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:04:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:05:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12470, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.75.123.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:10:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:25:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55921, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.60.104.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:10:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:52:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56277, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.116.193.77", "classifications": [], "first_seen": { "$date": "2023-03-04T03:04:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:46:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 958, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.125.66.18", "classifications": [], "first_seen": { "$date": "2023-03-04T03:14:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:32:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2883, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.103.236.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:15:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:35:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43457, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.144.139.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:18:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:37:04Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10267, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:19:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:19:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12444, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.53.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:20:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:20:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12444, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.240.46.8", "classifications": [], "first_seen": { "$date": "2023-03-04T03:22:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:22:34Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 12435, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "191.193.197.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:27:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:28:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12421, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.148.197.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:31:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:45:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 61936, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.174.183.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:32:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:56:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 184823, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.98.62.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:32:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:30:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 81174, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.154.209.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:34:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:30:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 75812, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.171.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:34:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:46:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55688, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.199.18.125", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:37:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:29:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 72336, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "173.82.83.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:43:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17604, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.165.242.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:44:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:57:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43240, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.110.212.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:28:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 112568, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.208.104.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:57:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49395, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.237.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:39:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:54:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 66", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8266, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.139.63.59", "classifications": [], "first_seen": { "$date": "2023-03-04T03:43:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:58:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA STREAM FIN out of window" ], "sightings": 59858, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 7, "classification_count": 0 }, { "ioc": "205.185.116.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:46:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:12:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55784, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.233.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:02:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19929, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.129.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:49:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:58:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43221, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.131.91.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:55:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:55:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24685, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.85.15.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:57:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:38:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 104" ], "sightings": 14990, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.234.71.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T03:59:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T03:59:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12345, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.7.162.198", "classifications": [], "first_seen": { "$date": "2023-03-04T03:50:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:00:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17", "ET SCAN Potential SSH Scan" ], "sightings": 1268, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "157.230.53.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:52:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:15:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 908, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.248.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T03:54:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:02:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2499, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.147.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:06:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:26:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16455, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.41", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:09:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:01:19Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19571, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "74.82.47.49", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:09:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:42:02Z" }, "ports": [ 177, 0, 80 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 40114, "tags": [ "udp", "xdmcp", "icmp", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.166.141.62", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T04:12:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:13:12Z" }, "ports": [ 110, 161, 162, 4021 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 24616, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.137", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:12:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:34:09Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 55696, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.86.83.125", "classifications": [], "first_seen": { "$date": "2023-03-04T04:10:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:10:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 613, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "24.107.127.238", "classifications": [], "first_seen": { "$date": "2023-03-04T04:15:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:15:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 613, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "84.228.49.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T04:15:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:16:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12305, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.116.131.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:20:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:20:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12304, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.106.40.174", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:29:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:48:01Z" }, "ports": [ 5050, 0, 5051, 5052, 5053, 5054, 5055, 5056, 5057, 5058, 5059, 5060, 5061, 5062, 5063, 5064, 5065, 5066, 5067, 5068, 5069, 5070, 5071, 5072, 5073, 5074, 5075, 5076, 5077, 5078, 5079, 5080, 5081, 5082, 5083, 5084, 5085, 5086, 5087, 5088, 5089, 5090, 5091, 5092, 5093, 5094, 5095, 5096, 5097, 5098, 5099, 5100 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) UDP portscan" ], "sightings": 930708, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "134.17.16.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T04:23:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:26:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2171, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.91.186.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T04:24:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:34:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46277, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.220.110.21", "classifications": [], "first_seen": { "$date": "2023-03-04T04:26:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:26:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1224, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.92.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:30:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:06:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12287, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.174.253.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T04:33:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:40:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 14" ], "sightings": 93229, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:36:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:05:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20396, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.226.66.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:38:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:44:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34758, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.232.123.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:41:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:43:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.178.152.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T04:43:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:43:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12178, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.135.14.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:50:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T04:50:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12169, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.104.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:55:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:05:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13000, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T04:59:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:11:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "158.160.33.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:02:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T11:25:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35963, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:03:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:11:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 51722, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.173.204.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T05:05:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:22:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54527, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "199.115.228.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T05:06:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:22:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 111" ], "sightings": 81211, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.199.210.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T05:07:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:03:15Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 6", "ET 3CORESec Poor Reputation IP group 2" ], "sightings": 61853, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "122.160.68.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T05:07:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48496, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.91.211.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T05:08:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:20:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42438, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.225.254.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:09:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:34:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24246, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.160.62.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T05:10:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:24:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18176, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.163.125.199", "classifications": [], "first_seen": { "$date": "2023-03-04T05:08:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:35:08Z" }, "ports": [ 80, 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 1150, "tags": [ "alert", "tcp", "http", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "82.55.187.245", "classifications": [], "first_seen": { "$date": "2023-03-04T05:12:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:12:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 609, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.143.67.17", "classifications": [], "first_seen": { "$date": "2023-03-04T05:14:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:16:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 37148, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "54.219.105.57", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:16:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:16:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 150646, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "204.42.253.132", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:29:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:40:47Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32813, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "113.192.108.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T05:33:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:35:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24178, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.88.165.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:47:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:42:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 39433, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.19.232.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:49:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:57:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72282, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.99.234.34", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:51:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:51:49Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48261, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "177.11.184.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:52:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:17:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20403, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.53.199.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:56:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T05:56:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.88.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T05:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T07:14:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 176", "ET SCAN Potential SSH Scan" ], "sightings": 56687, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T05:49:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:26:06Z" }, "ports": [ 22, 0 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7351, "tags": [ "alert", "tcp", "ssh", "Go", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "122.163.120.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T06:00:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:24:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 93149, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "70.114.119.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T06:01:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:53:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7117, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.147.171.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:03:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:06:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 72058, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.250.96.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:11:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:11:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12045, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:15:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:26:42Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 26255, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "60.208.44.206", "classifications": [], "first_seen": { "$date": "2023-03-04T06:15:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:20:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1811, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.1.227.61", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:22:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:12:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 69786, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "89.217.196.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T06:30:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:31:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12024, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.131.84.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T06:31:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:32:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12018, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:32:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:42:50Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16027, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:32:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:22:44Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13583, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "188.166.240.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T06:38:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:52:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47965, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.244.50.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:18:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35942, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.22.201.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T06:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:48:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 57" ], "sightings": 12128, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "216.218.206.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:48:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:09:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22237, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.109.46.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T06:52:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:02:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41933, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.247.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:53:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:53:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35967, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.62.3.65", "classifications": [], "first_seen": { "$date": "2023-03-04T06:53:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T06:53:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid request line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) invalid status line" ], "sightings": 23991, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "176.97.210.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:55:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:57:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.92.127.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T06:56:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30992, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.189.7.30", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-04T07:00:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:21:39Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 94659, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.48.192.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:05:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:54:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 178531, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "94.102.61.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T07:19:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:30:23Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 280923, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "216.218.206.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T07:20:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:54:41Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 31228, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "31.0.128.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:25:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:25:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11954, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.251.216.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:25:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:34:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 109955, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.193.31.181", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T07:26:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:26:36Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23892, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "112.173.174.97", "classifications": [], "first_seen": { "$date": "2023-03-04T07:26:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:26:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 599, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "74.82.47.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T07:35:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:42:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.86.180.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:36:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:47:16Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 9" ], "sightings": 276933, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.194.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:37:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:49:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53547, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.83.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:39:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:39:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 67957, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.37.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:39:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:53:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53539, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.84.239.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:44:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:17:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 71132, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.77.25.140", "classifications": [], "first_seen": { "$date": "2023-03-04T07:31:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:33:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1196, "tags": [ "ssh", "tcp", "ssh", "Go", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.199.114.5", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T07:35:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:34:23Z" }, "ports": [ 22, 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 618, "tags": [ "ssh", "tcp", "ssh", "ssh", "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "60.49.64.75", "classifications": [], "first_seen": { "$date": "2023-03-04T07:39:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:39:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 598, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "183.252.189.55", "classifications": [], "first_seen": { "$date": "2023-03-04T07:42:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:57:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1793, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.39.17.214", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T07:51:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:07:08Z" }, "ports": [ 161, 162 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 22560, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.193.192.198", "classifications": [], "first_seen": { "$date": "2023-03-04T07:54:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T07:54:42Z" }, "ports": [ 37215 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 11898, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.22", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-04T07:56:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:27:07Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 33054, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "78.49.36.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T07:57:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:09:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53357, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.33.53.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:02:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:15:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 68077, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.64.54.242", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:02:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:23:09Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42631, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.251.21", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:02:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:02:52Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17807, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "109.134.162.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:03:51Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:12:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 14", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET SCAN Potential SSH Scan" ], "sightings": 65430, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6", "anomaly" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "109.62.166.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:03:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:21:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58970, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.137.69.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:04:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:27:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41924, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.5.145.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:04:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:21:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 64844, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.68.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:06:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:20:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53073, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.139.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:06:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:19:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23617, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.193.31.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:07:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:16:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 126", "ET SCAN Potential SSH Scan" ], "sightings": 53339, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "92.241.82.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:07:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:20:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187", "ET SCAN Potential SSH Scan" ], "sightings": 53298, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "110.11.234.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:07:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:56:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 80404, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.109.232.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:08:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:20:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58941, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.67.221.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:08:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:22:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52973, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.161.176.1", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:09:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:00:37Z" }, "ports": [ 22, 0 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 156" ], "sightings": 108065, "tags": [ "tcp", "ssh", "icmp", "alert" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "188.121.116.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:10:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:21:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52968, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.254.83.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:10:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:11:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11828, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.189.0.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:12:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:12:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11815, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.22.85.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:12:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:14:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 175026, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.210.83.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:14:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:29:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46933, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.57.164.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:09:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T21:10:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 94", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 656, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.73.179.114", "classifications": [], "first_seen": { "$date": "2023-03-04T08:10:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:15:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 21" ], "sightings": 22574, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "37.235.48.116", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:18:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:23:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 124364, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "168.62.30.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:29:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:51:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 94204, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.36.241", "classifications": [], "first_seen": { "$date": "2023-03-04T08:16:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:11:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 39", "ET SCAN Potential SSH Scan" ], "sightings": 28505, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "139.198.32.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:30:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:56:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 174552, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.135.145.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:30:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:45:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58447, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.69", "classifications": [ "Misc activity", "Decode of an RPC Query", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T08:33:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:10:43Z" }, "ports": [ 0, 111, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 21957, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "187.135.96.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:34:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:34:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5861, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:35:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:59:18Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 12169, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "202.169.46.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:35:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:52:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58396, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.106.73.114", "classifications": [], "first_seen": { "$date": "2023-03-04T08:39:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:28:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 179", "ET SCAN Potential SSH Scan" ], "sightings": 29620, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "221.213.63.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:39:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:05:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 598, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.219.62.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:41:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:59:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29107, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "124.41.217.33", "classifications": [], "first_seen": { "$date": "2023-03-04T08:41:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:47:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 24" ], "sightings": 21899, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "146.59.195.105", "classifications": [], "first_seen": { "$date": "2023-03-04T08:42:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:42:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49" ], "sightings": 594, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "188.166.52.232", "classifications": [], "first_seen": { "$date": "2023-03-04T08:44:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:44:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 99" ], "sightings": 594, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.188.19.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:47:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:47:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11692, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.182.180.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:48:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:03:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58256, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.227.211.207", "classifications": [], "first_seen": { "$date": "2023-03-04T08:50:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:50:46Z" }, "ports": [ 8080 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 11685, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.94.122.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:50:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:05:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58227, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "24.112.56.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:51:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:52:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11681, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T08:53:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:07:55Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 32499, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "75.7.3.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T08:59:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T08:59:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11662, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.116.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T09:04:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:59:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23266, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T09:19:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:12:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18970, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.23.104", "classifications": [], "first_seen": { "$date": "2023-03-04T09:19:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:19:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 31" ], "sightings": 591, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.248.60.70", "classifications": [], "first_seen": { "$date": "2023-03-04T09:29:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:33:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 7", "ET SCAN Potential SSH Scan" ], "sightings": 23403, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "203.170.190.231", "classifications": [], "first_seen": { "$date": "2023-03-04T09:29:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:50:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120" ], "sightings": 23526, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "217.133.27.74", "classifications": [], "first_seen": { "$date": "2023-03-04T09:30:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:30:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 130", "ET 3CORESec Poor Reputation IP group 29" ], "sightings": 1182, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.101.176.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T09:31:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:29:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 159", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8514, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.36.133.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T09:31:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:31:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11642, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.91.250.98", "classifications": [], "first_seen": { "$date": "2023-03-04T09:38:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:38:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 5815, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.22.223.41", "classifications": [], "first_seen": { "$date": "2023-03-04T09:31:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:31:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 71" ], "sightings": 590, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.95.68.112", "classifications": [], "first_seen": { "$date": "2023-03-04T09:32:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:32:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 134" ], "sightings": 590, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.2.88.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T09:35:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:32:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 57", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6496, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "200.13.244.219", "classifications": [], "first_seen": { "$date": "2023-03-04T09:40:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T09:43:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1180, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "174.138.185.11", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-04T09:57:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:21:07Z" }, "ports": [ 5060, 0, 5070, 5071, 5072, 5073, 5074, 5076, 5077, 5078, 5079, 5081, 5082, 5083, 6060 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 66102, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "222.64.158.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T09:57:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:50:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21675, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.239.18.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:00:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:00:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11620, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "98.142.133.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:02:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:17:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57909, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.242.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:02:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:35:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63761, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.146.205.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:03:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:58:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54889, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.94.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T10:03:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:55:15Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22788, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "202.44.230.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:03:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:10:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 76985, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.230.203.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:04:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:46:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 169" ], "sightings": 68114, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.129.241.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:04:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:31:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 92511, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.210.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:05:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:44:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40495, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.172.246.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:06:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:23:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 86748, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.193.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:07:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:19:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52105, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.55.147.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:14:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:14:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11669, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.112.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T10:07:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:36:03Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3188, "tags": [ "alert", "tcp", "ssh", "anomaly", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "220.133.192.163", "classifications": [], "first_seen": { "$date": "2023-03-04T10:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:09:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 1764, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "217.79.42.236", "classifications": [], "first_seen": { "$date": "2023-03-04T10:14:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:06:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 130", "ET SCAN Potential SSH Scan" ], "sightings": 28713, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "212.129.51.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T10:28:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:20:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35821, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.222.26.130", "classifications": [], "first_seen": { "$date": "2023-03-04T10:17:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:40:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 112" ], "sightings": 22232, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "81.215.203.19", "classifications": [], "first_seen": { "$date": "2023-03-04T10:20:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:20:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 80" ], "sightings": 587, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "102.248.1.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T10:34:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:34:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11563, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.119.3.189", "classifications": [], "first_seen": { "$date": "2023-03-04T10:40:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:40:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is missing" ], "sightings": 5782, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.31.94.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:40:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11562, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.173.156", "classifications": [], "first_seen": { "$date": "2023-03-04T10:42:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:36:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 10515, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.87.32.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:57:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30625, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.196.113.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:02:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63372, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.168.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:28:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53925, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.57.193.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:47:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:47:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11556, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.48.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:48:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:03:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 69103, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "88.247.78.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:48:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:26:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9687, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.22.30.173", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-03-04T10:54:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:15:44Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 277085, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.23.165.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T10:58:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:09:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51786, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.227.185.119", "classifications": [], "first_seen": { "$date": "2023-03-04T10:49:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 172" ], "sightings": 585, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "99.241.242.242", "classifications": [], "first_seen": { "$date": "2023-03-04T10:49:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:35:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 17510, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "202.169.46.155", "classifications": [], "first_seen": { "$date": "2023-03-04T10:53:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T10:53:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 117" ], "sightings": 585, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.38.81.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T11:06:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:18:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23028, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "110.77.236.185", "classifications": [], "first_seen": { "$date": "2023-03-04T11:04:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:48:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA STREAM Last ACK with wrong seq" ], "sightings": 45168, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "119.204.139.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T11:22:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:58:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 18599, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.216.60.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T11:25:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:25:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11516, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.47.144.69", "classifications": [], "first_seen": { "$date": "2023-03-04T11:26:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:26:35Z" }, "ports": [ 81 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 11515, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.152.52.90", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-04T11:26:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:27:32Z" }, "ports": [ 0, 465, 162, 43, 5060, 161, 1900, 53 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) TCP portscan", "PROTOCOL-SNMP trap udp", "(port_scan) UDP portscan", "(sip) content length mismatch", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt" ], "sightings": 460267, "tags": [ "icmp", "tcp", "udp", "snmptrap", "snmp" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "45.128.232.101", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T11:29:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:28:27Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 122071, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "101.53.134.175", "classifications": [], "first_seen": { "$date": "2023-03-04T11:20:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:24:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 44308, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "104.131.190.193", "classifications": [], "first_seen": { "$date": "2023-03-04T11:21:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:11:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 10", "ET 3CORESec Poor Reputation IP group 2", "ET SCAN Potential SSH Scan" ], "sightings": 29772, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "111.243.43.163", "classifications": [], "first_seen": { "$date": "2023-03-04T11:23:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:34:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2913, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "158.101.165.108", "classifications": [], "first_seen": { "$date": "2023-03-04T11:25:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:25:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 57" ], "sightings": 583, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.153.103.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:30:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:39:50Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 148", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3615, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.8.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:31:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:07:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 46", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13498, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "51.15.157.46", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-03-04T11:32:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:10:41Z" }, "ports": [ 0, 5060, 5080, 1030 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 187737, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "186.67.248.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:34:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:00:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13857, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.242.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:34:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:50:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51345, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.167.47.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:36:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:49:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 57052, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.215.195.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:42:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 187077, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.187.215.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:37:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:49:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39952, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.135.54.2", "classifications": [], "first_seen": { "$date": "2023-03-04T11:33:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:33:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 582, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.156.31.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:34:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:54:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153", "ET 3CORESec Poor Reputation IP group 35", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17801, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "188.81.133.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:34:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:21:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 99", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8078, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.65.173.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:44:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:39:17Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62852, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.61.206.205", "classifications": [], "first_seen": { "$date": "2023-03-04T11:45:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:32:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 12751, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.155.70.28", "classifications": [], "first_seen": { "$date": "2023-03-04T11:45:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:38:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8696, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.251.16", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T11:46:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:48:20Z" }, "ports": [ 0, 161, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 21965, "tags": [ "icmp", "tcp", "snmp", "snmptrap" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.154.0.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:53:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:58:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 414232, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.72.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:54:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:07:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45354, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.222.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T11:55:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:10:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15075, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.15.8.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T11:56:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:02:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13851, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.18.131.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T11:57:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:07:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 45453, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "136.33.247.88", "classifications": [], "first_seen": { "$date": "2023-03-04T11:47:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:48:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1743, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "96.57.229.164", "classifications": [], "first_seen": { "$date": "2023-03-04T11:50:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:50:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 581, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "189.155.197.225", "classifications": [], "first_seen": { "$date": "2023-03-04T11:50:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:50:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1162, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "146.90.93.17", "classifications": [], "first_seen": { "$date": "2023-03-04T11:57:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T11:57:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1162, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "36.170.39.166", "classifications": [], "first_seen": { "$date": "2023-03-04T11:58:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:01:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1160, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.24.2.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:00:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:01:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11350, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.149.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:04:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18934, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.206.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:45:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17801, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.251.33.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:13:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:13:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11329, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.240.118.71", "classifications": [], "first_seen": { "$date": "2023-03-04T12:06:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:06:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 87" ], "sightings": 579, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "158.160.34.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:18:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:38:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 57", "ET SCAN Potential SSH Scan" ], "sightings": 59873, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.91.110.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:19:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:59:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 92687, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.149.55.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:19:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:22:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 114" ], "sightings": 183104, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.140.61.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:19:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:34:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44857, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.224.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:19:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:33:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56106, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.92.180.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:26:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 70506, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.236.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:20:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:15:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60304, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.170.240.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:20:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:15:46Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 128", "ET SCAN Potential SSH Scan" ], "sightings": 143577, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.155.130.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:20:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:34:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50485, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.41.209.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:21:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:32:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50521, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.216.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:21:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:32:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50527, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.110.254.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:21:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:34:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33629, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.83.137.173", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:24:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:02:14Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 162400, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "65.185.92.110", "classifications": [], "first_seen": { "$date": "2023-03-04T12:20:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:20:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 578, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "220.250.41.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:22:08Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:20:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3504, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.55.189.252", "classifications": [], "first_seen": { "$date": "2023-03-04T12:22:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:22:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 158" ], "sightings": 578, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.156.155.3", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T12:32:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:04:15Z" }, "ports": [ 8991, 5938, 8052, 56052, 161 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 27437, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.4.191.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:40:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:40:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11145, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.233.150.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T12:42:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:43:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11142, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.3.14.93", "classifications": [], "first_seen": { "$date": "2023-03-04T12:33:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:37:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 19070, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "47.109.30.230", "classifications": [], "first_seen": { "$date": "2023-03-04T12:39:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:39:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 13800, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "157.230.225.231", "classifications": [], "first_seen": { "$date": "2023-03-04T12:41:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:44:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 13222, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "96.56.99.75", "classifications": [], "first_seen": { "$date": "2023-03-04T12:41:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:41:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 91" ], "sightings": 1150, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "148.153.204.58", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:46:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:23:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 76069, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.106.94.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:48:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:48:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11123, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.250.24", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:55:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:43:27Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22629, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.208.135", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:56:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:56:34Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16670, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "158.69.5.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T12:59:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T14:08:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20621, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.225.221", "classifications": [], "first_seen": { "$date": "2023-03-04T12:51:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T12:51:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1146, "tags": [ "ssh", "tcp", "ssh", "HELLOWORLD", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "60.30.98.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T13:05:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:55:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 115685, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.197.205.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T13:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:22:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49894, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.7.129.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T13:07:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:24:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38816, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.34.153.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T13:11:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:11:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11107, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.231.238.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T13:16:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:21:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 56997, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.92.242.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T13:25:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:25:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11089, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.91.61.108", "classifications": [], "first_seen": { "$date": "2023-03-04T13:22:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:24:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 29659, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "118.170.130.4", "classifications": [], "first_seen": { "$date": "2023-03-04T13:25:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:25:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 570, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.95.55.75", "classifications": [], "first_seen": { "$date": "2023-03-04T13:37:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP redirect host", "ICMP Traffic Detected" ], "sightings": 33598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.134.186.9", "classifications": [], "first_seen": { "$date": "2023-03-04T13:42:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:36:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 11325, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.21.99.227", "classifications": [], "first_seen": { "$date": "2023-03-04T13:44:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:37:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 15291, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "121.164.64.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T13:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:49:55Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21241, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "98.98.170.134", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T13:50:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:09:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 118697, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.243.149.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T13:58:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T13:58:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11073, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.158.25.191", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-04T14:11:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:33:05Z" }, "ports": [ 5060, 0, 65476 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 348725, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.59.252.103", "classifications": [], "first_seen": { "$date": "2023-03-04T14:03:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:34:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 916, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.189.6.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T14:17:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:37:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 73257, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.74.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:24:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:07:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 165472, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.33.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:26:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:41:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60672, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.206.175.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:29:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:18:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46211, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.146.8.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:21:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45148, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.59.254.169", "classifications": [], "first_seen": { "$date": "2023-03-04T14:24:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:39:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 5080, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.145.181.242", "classifications": [], "first_seen": { "$date": "2023-03-04T14:26:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:26:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 3" ], "sightings": 565, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.2.73.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:26:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:13:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 168", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48629, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.84.236.242", "classifications": [], "first_seen": { "$date": "2023-03-04T14:27:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:21:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 9" ], "sightings": 33772, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.170.151.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:27:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:18:27Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 112", "ET 3CORESec Poor Reputation IP group 26", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1217, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.134.78.211", "classifications": [], "first_seen": { "$date": "2023-03-04T14:30:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:29:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 147", "ET SCAN Potential SSH Scan" ], "sightings": 21956, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "128.199.52.104", "classifications": [], "first_seen": { "$date": "2023-03-04T14:30:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:18:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 27", "ET SCAN Potential SSH Scan" ], "sightings": 27592, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "128.199.140.105", "classifications": [], "first_seen": { "$date": "2023-03-04T14:30:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:24:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 9014, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.154.128.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T14:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:35:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33143, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.147.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T14:40:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:40:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11047, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.194.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:40:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:40:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11045, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.0.90.52", "classifications": [], "first_seen": { "$date": "2023-03-04T14:33:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:33:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1128, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "85.194.57.132", "classifications": [], "first_seen": { "$date": "2023-03-04T14:42:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:42:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 564, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.142.179.180", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T14:47:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:47:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 27591, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "182.74.230.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:14:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 229231, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.159.221.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:48:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:03:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44020, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.93.237.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:49:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:03:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44015, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.240.27.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:49:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:04:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49511, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.65.89.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:49:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:49:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5518, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.78.245.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:34:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 164462, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.244.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:55:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:10:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 32", "ET 3CORESec Poor Reputation IP group 12" ], "sightings": 55498, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "143.198.174.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T14:59:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:16:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 93487, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.97.125", "classifications": [], "first_seen": { "$date": "2023-03-04T14:47:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:38:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62", "ET 3CORESec Poor Reputation IP group 16", "ET SCAN Potential SSH Scan" ], "sightings": 28093, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "85.18.236.229", "classifications": [], "first_seen": { "$date": "2023-03-04T14:47:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:42:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 184", "ET SCAN Potential SSH Scan" ], "sightings": 29794, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "185.237.15.141", "classifications": [], "first_seen": { "$date": "2023-03-04T14:48:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:02:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3377, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "89.248.163.242", "classifications": [], "first_seen": { "$date": "2023-03-04T14:52:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T14:52:24Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 582, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "65.20.167.208", "classifications": [], "first_seen": { "$date": "2023-03-04T15:01:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:01:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 563, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "122.117.52.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:00:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:01:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16501, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.225.22.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:07:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:21:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60245, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.85.34.53", "classifications": [], "first_seen": { "$date": "2023-03-04T15:01:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:52:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 189", "ET SCAN Potential SSH Scan" ], "sightings": 28579, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "196.0.120.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:03:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:36:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 108", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34223, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.63.212.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:18:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:33:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49", "ET 3CORESec Poor Reputation IP group 13", "ET SCAN Potential SSH Scan" ], "sightings": 63335, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "113.21.232.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:35:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 66473, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.25.108.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T15:25:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:25:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10951, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.251.103", "classifications": [], "first_seen": { "$date": "2023-03-04T15:20:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T16:08:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 11176, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.135.154.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:20:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:00:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 147", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3061, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.212.107.18", "classifications": [], "first_seen": { "$date": "2023-03-04T15:20:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:20:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 561, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "205.185.120.194", "classifications": [], "first_seen": { "$date": "2023-03-04T15:22:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:22:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 121" ], "sightings": 561, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "180.64.115.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:22:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:33:42Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 87", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 59967, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "92.222.10.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:23:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:07:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63973, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "71.196.135.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:34:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:50:30Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 72", "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan" ], "sightings": 15214, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "103.105.176.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:35:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:35:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10930, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.224.128.13", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-04T15:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T08:09:37Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 166240, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "122.202.44.18", "classifications": [], "first_seen": { "$date": "2023-03-04T15:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:39:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 559, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.119.9.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T15:42:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:43:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 155", "ET 3CORESec Poor Reputation IP group 36", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45164, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.60.136.203", "classifications": [], "first_seen": { "$date": "2023-03-04T15:44:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T15:48:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 39051, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "67.217.62.190", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-03-04T15:58:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T22:36:50Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 109199, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.246.18.26", "classifications": [ "Detection of a Network Scan", "Misc activity", "Decode of an RPC Query", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T16:01:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:33:10Z" }, "ports": [ 1900, 0, 111, 161 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 325917, "tags": [ "udp", "icmp", "sunrpc", "portmapper", "snmp" ], "rule_count": 6, "classification_count": 4 }, { "ioc": "136.50.241.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T16:01:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T16:02:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10904, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.157.60.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T16:04:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T16:04:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10905, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.113.194.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T16:15:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:43:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 55485, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.154.63.184", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-03-04T16:23:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:52:31Z" }, "ports": [ 0, 5090, 1040, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 89084, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "201.249.166.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T16:26:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T16:41:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32632, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.71.47.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T16:59:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:10:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48826, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.20.18.120", "classifications": [], "first_seen": { "$date": "2023-03-04T16:49:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T16:49:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 552, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "187.33.56.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:00:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:09:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 37990, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.210.28.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T17:00:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T17:38:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60594, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.40.9.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:00:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:02:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10864, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.106.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:04:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:45:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 69373, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.42.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:05:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 95500, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "196.46.191.31", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T17:05:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:30:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 56360, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.177", "classifications": [ "Attempted Information Leak", "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:05:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:51:27Z" }, "ports": [ 161, 0, 1434, 22 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24166, "tags": [ "udp", "snmp", "icmp", "tcp", "ssh" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "137.184.50.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:06:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:33:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 86281, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.71.142.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:06:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:53:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49691, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "131.161.36.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:10:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:24:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43258, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.205.161.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:11:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:03:33Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16206, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.249.25.205", "classifications": [], "first_seen": { "$date": "2023-03-04T17:11:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:11:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 551, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.69.251.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:23:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:34:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48513, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.70.38.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:24:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:33:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.94.138.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T17:28:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:28:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10789, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.211.191.118", "classifications": [], "first_seen": { "$date": "2023-03-04T17:21:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:08:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA TCPv4 invalid checksum" ], "sightings": 84006, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go", "libssh_0.7.4" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "187.33.202.7", "classifications": [], "first_seen": { "$date": "2023-03-04T17:21:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:21:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1647, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "157.245.156.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:32:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:00:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 74631, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.209.32.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:33:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:45:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 32", "ET 3CORESec Poor Reputation IP group 12" ], "sightings": 48407, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "184.168.123.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:33:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:59:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 160857, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.59.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:35:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:50:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53760, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.229.138.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T17:38:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:38:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10768, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.9.140.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T17:39:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:04:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18710, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.99", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-04T17:50:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:34:04Z" }, "ports": [ 0, 161, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-TFTP Get" ], "sightings": 46543, "tags": [ "icmp", "udp", "snmp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "185.224.128.247", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-04T17:51:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:17:12Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32195, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.97.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T17:53:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T17:53:45Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16123, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.221.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T17:55:19Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:22:38Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18493, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "173.32.119.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:13:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:13:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10723, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.27.187.146", "classifications": [], "first_seen": { "$date": "2023-03-04T18:07:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:07:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1090, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "61.74.127.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T18:20:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:21:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10717, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.211.100.151", "classifications": [], "first_seen": { "$date": "2023-03-04T18:28:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:28:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 5359, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.146.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:33:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:06:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.140", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T18:34:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:21:38Z" }, "ports": [ 0, 22, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 41549, "tags": [ "icmp", "tcp", "ssh", "alert", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "195.24.207.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:34:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:34:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10709, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.217.131.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:36:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:22:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31707, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.112.72.254", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-03-04T18:39:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:49:48Z" }, "ports": [ 0, 53, 443 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt", "(stream_tcp) data on SYN packet" ], "sightings": 117786, "tags": [ "icmp", "udp", "tcp", "https" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "49.71.81.253", "classifications": [], "first_seen": { "$date": "2023-03-04T18:44:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:44:18Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 10705, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "217.165.156.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:44:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:44:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10702, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.123.97.240", "classifications": [], "first_seen": { "$date": "2023-03-04T18:31:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:51:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 7045, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert", "anomaly" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "132.248.204.85", "classifications": [], "first_seen": { "$date": "2023-03-04T18:32:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:25:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 11895, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.42.188.197", "classifications": [], "first_seen": { "$date": "2023-03-04T18:32:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:20:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 16211, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.163.228.20", "classifications": [], "first_seen": { "$date": "2023-03-04T18:32:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:26:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 12642, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.138.184.8", "classifications": [], "first_seen": { "$date": "2023-03-04T18:33:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:26:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 9733, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.81.32.153", "classifications": [], "first_seen": { "$date": "2023-03-04T18:33:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:21:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 10279, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.136.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T18:36:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:49:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 66", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 952, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.156.237.42", "classifications": [], "first_seen": { "$date": "2023-03-04T18:36:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:53:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1627, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.232.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:48:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:41:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23412, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.212.100.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:50:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:50:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10695, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.192.46.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T18:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:43:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58745, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.162.89.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:52:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10693, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T18:53:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:17:44Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 14870, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "58.29.85.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T18:58:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:59:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10687, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.190.100.59", "classifications": [], "first_seen": { "$date": "2023-03-04T18:47:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:47:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 541, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "142.176.55.105", "classifications": [], "first_seen": { "$date": "2023-03-04T18:48:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:41:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 696, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "113.249.156.222", "classifications": [], "first_seen": { "$date": "2023-03-04T18:49:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:52:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 30296, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "77.158.71.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T18:58:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:24:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 178", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27571, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "54.37.204.179", "classifications": [], "first_seen": { "$date": "2023-03-04T18:58:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T18:58:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 168", "ET 3CORESec Poor Reputation IP group 38" ], "sightings": 1200, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "158.101.69.210", "classifications": [], "first_seen": { "$date": "2023-03-04T19:00:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:22:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 57", "ET 3CORESec Poor Reputation IP group 15" ], "sightings": 17187, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.243.145.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T19:07:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:07:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10677, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.15.130.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T19:02:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:11:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 163", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30940, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "202.29.13.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T19:04:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:11:02Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3345, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.51.103.145", "classifications": [], "first_seen": { "$date": "2023-03-04T19:04:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:01:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 11294, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.156.41.4", "classifications": [], "first_seen": { "$date": "2023-03-04T19:07:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:34:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153", "ET SCAN Potential SSH Scan" ], "sightings": 15502, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "143.42.173.155", "classifications": [], "first_seen": { "$date": "2023-03-04T19:07:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:46:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 16135, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "60.108.212.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T19:08:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:28:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 170", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 858, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T19:16:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:15:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11242, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.93.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T19:19:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:05:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12405, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.123.105.86", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T19:24:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:44:42Z" }, "ports": [ 0, 53 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 38526, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "95.250.210.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T19:24:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:25:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10654, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.25", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T19:27:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T08:19:44Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 14020, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "170.17.138.107", "classifications": [], "first_seen": { "$date": "2023-03-04T19:21:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:21:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 538, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.137.44.183", "classifications": [], "first_seen": { "$date": "2023-03-04T19:26:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T19:29:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2152, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.95.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T19:34:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:40:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12876, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.163.234.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T19:59:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:50:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57604, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.104.101.168", "classifications": [], "first_seen": { "$date": "2023-03-04T19:49:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:03:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4286, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "137.184.135.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:01:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:57:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 114215, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "39.129.9.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:02:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:02:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10639, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.103.15.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:04:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:54:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 169680, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.211.100.138", "classifications": [], "first_seen": { "$date": "2023-03-04T20:11:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:16:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 40660, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "114.35.79.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:17:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:17:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10622, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.210.206.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:20:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:31:28Z" }, "ports": [ 22, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 158495, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "220.133.95.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:20:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:27:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37131, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.101.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T20:20:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:40:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.142.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:22:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:33:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42404, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.133.18", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-04T20:26:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:26:15Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15923, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "159.203.192.13", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-04T20:26:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:07:24Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15959, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "95.156.230.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T20:28:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:28:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.95.72.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T20:28:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:28:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.228.129.26", "classifications": [], "first_seen": { "$date": "2023-03-04T20:26:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:26:27Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 26" ], "sightings": 534, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.159.36.82", "classifications": [], "first_seen": { "$date": "2023-03-04T20:28:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:40:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3732, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.50.11.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T20:39:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:39:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10586, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.142.236.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:41:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:42:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10581, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.95.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:44:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:20:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 84986, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.253.27.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:44:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:57:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42225, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.28.209.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:53:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:53:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5279, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "24.231.22.127", "classifications": [], "first_seen": { "$date": "2023-03-04T20:59:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T20:59:07Z" }, "ports": [ 37215 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 10555, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.168.123.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:48:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:48:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2484, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.83.45.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T20:55:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:20:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 166", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66491, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "34.126.71.110", "classifications": [], "first_seen": { "$date": "2023-03-04T20:56:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:20:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 137", "ET SCAN Potential SSH Scan" ], "sightings": 49206, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "79.188.52.121", "classifications": [], "first_seen": { "$date": "2023-03-04T20:58:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:51:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 179", "ET 3CORESec Poor Reputation IP group 43", "ET SCAN Potential SSH Scan" ], "sightings": 26453, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "188.10.96.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:05:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:44:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10753, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T21:10:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:55:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33343, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.116.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T21:14:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:25:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21076, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.168.40", "classifications": [], "first_seen": { "$date": "2023-03-04T21:02:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:16:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4554, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "217.219.223.36", "classifications": [], "first_seen": { "$date": "2023-03-04T21:03:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:04:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 33920, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "103.153.255.107", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T21:15:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:26:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 51898, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.173.251.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T21:28:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:28:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T21:28:25Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:27:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13060, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.209.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:29:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:40:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42047, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.248.209.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T21:29:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:29:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10530, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.127.181.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:29:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:42:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.66.172.124", "classifications": [], "first_seen": { "$date": "2023-03-04T21:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:21:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3703, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "75.140.53.210", "classifications": [], "first_seen": { "$date": "2023-03-04T21:23:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:23:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 529, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.51.77.201", "classifications": [], "first_seen": { "$date": "2023-03-04T21:28:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:28:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 529, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.144.60.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:30:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:09:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 157080, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.254.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T21:31:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:38:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.107.68.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:37:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:37:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10519, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.192.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T21:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:06:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.148.24", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-04T21:43:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:14:53Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 10522, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "114.26.26.200", "classifications": [], "first_seen": { "$date": "2023-03-04T21:34:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:34:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 528, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "31.171.108.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:50:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:39:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46603, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "213.74.115.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:51:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:05:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47144, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "99.254.178.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:53:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:57:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15732, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.211.217.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:53:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:31:23Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 6", "ET SCAN Potential SSH Scan" ], "sightings": 122445, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "188.217.186.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:53:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:09:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 15342, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "201.163.162.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T21:54:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:33:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 156504, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "223.205.214.52", "classifications": [], "first_seen": { "$date": "2023-03-04T21:54:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:54:56Z" }, "ports": [ 8088 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 10490, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "113.131.101.124", "classifications": [], "first_seen": { "$date": "2023-03-04T21:49:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T21:49:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1581, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.241.209.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T22:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:08:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10470, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "204.44.93.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T22:10:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:07:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19456, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.136.16", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T22:11:37Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:08:04Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 14138, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "71.6.231.8", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T22:13:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:13:37Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15689, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.192.20", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T22:27:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:23:00Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 15652, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "218.149.97.96", "classifications": [], "first_seen": { "$date": "2023-03-04T22:20:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:20:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 525, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "111.95.141.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T22:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:12:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40155, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "209.97.149.37", "classifications": [], "first_seen": { "$date": "2023-03-04T22:30:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:19:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 125", "ET 3CORESec Poor Reputation IP group 28", "ET SCAN Potential SSH Scan" ], "sightings": 27204, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "168.228.220.253", "classifications": [], "first_seen": { "$date": "2023-03-04T22:31:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:33:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 77" ], "sightings": 19868, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "180.233.120.130", "classifications": [], "first_seen": { "$date": "2023-03-04T22:44:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:44:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 18452, "tags": [ "tcp", "ssh", "alert", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "2.228.139.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T22:35:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:25:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 133", "ET 3CORESec Poor Reputation IP group 25", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1102, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "203.194.101.247", "classifications": [], "first_seen": { "$date": "2023-03-04T22:38:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:36:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120", "ET 3CORESec Poor Reputation IP group 27", "ET SCAN Potential SSH Scan" ], "sightings": 21420, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "68.183.54.210", "classifications": [], "first_seen": { "$date": "2023-03-04T22:39:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:29:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 10452, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.143.255.70", "classifications": [], "first_seen": { "$date": "2023-03-04T22:40:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:10:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 18824, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.70.121.94", "classifications": [], "first_seen": { "$date": "2023-03-04T22:47:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:47:22Z" }, "ports": [ 81 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 10426, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.113.179", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T22:48:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:25:36Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 16479, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.216.8", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T22:49:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:59:19Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21687, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.232.14", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-04T22:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:52:31Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20842, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.144.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T22:54:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:13:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19045, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.192.108.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T22:58:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:58:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10420, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.247.114.26", "classifications": [], "first_seen": { "$date": "2023-03-04T22:53:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T22:53:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1569, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "187.255.61.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T22:56:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:55:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1940, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.189.25.136", "classifications": [], "first_seen": { "$date": "2023-03-04T22:58:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:12:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 4178, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "188.255.87.214", "classifications": [], "first_seen": { "$date": "2023-03-04T23:13:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:13:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 5210, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.205.23.211", "classifications": [], "first_seen": { "$date": "2023-03-04T23:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:05:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 522, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "172.104.97.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-04T23:15:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:16:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19672, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.220.185.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T23:18:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:34:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52020, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.16.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T23:29:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:57:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33326, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "50.221.60.106", "classifications": [], "first_seen": { "$date": "2023-03-04T23:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:31:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 162" ], "sightings": 1042, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "50.217.212.2", "classifications": [], "first_seen": { "$date": "2023-03-04T23:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:02:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10900, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "36.251.95.125", "classifications": [], "first_seen": { "$date": "2023-03-04T23:45:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:45:54Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 10401, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.250.87.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T23:50:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:19:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 108766, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.111.231.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T23:51:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:04:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46687, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.206.14.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T23:53:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:55:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43268, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.167.96.146", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-04T23:53:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:19:05Z" }, "ports": [ 162, 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 8238, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.147.33.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-04T23:56:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:36:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12711, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.52.38.101", "classifications": [], "first_seen": { "$date": "2023-03-04T23:53:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-04T23:53:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 9" ], "sightings": 519, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.39.30.159", "classifications": [], "first_seen": { "$date": "2023-03-05T00:00:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:00:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 518, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "79.6.171.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:00:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:00:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10387, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.184.121.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:01:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:01:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10384, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.123", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-05T00:01:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:17:33Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 10407, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.142.125.142", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T00:02:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:56:13Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 29143, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.10.245.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:09:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:28:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63624, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.134.144.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T00:14:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:19:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72697, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.90.233", "classifications": [], "first_seen": { "$date": "2023-03-05T00:05:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:05:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1551, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "74.82.47.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T00:19:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:28:21Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 19702, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.210.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T00:20:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:20:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10362, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.144.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:21:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:21:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10362, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.47.108.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:21:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:21:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10355, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.85", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-05T00:29:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:27:46Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 41833, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "200.192.97.64", "classifications": [], "first_seen": { "$date": "2023-03-05T00:27:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:45:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5141, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "113.22.72.124", "classifications": [], "first_seen": { "$date": "2023-03-05T00:28:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:28:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 515, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "201.236.186.32", "classifications": [], "first_seen": { "$date": "2023-03-05T00:31:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:19:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 115" ], "sightings": 11209, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.117.134.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:31:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:32:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10346, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.33.12.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:34:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:34:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10343, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T00:36:12Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:41:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16960, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.138.72.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:37:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:02:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.132.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:41:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:52:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25", "ET 3CORESec Poor Reputation IP group 11", "ET SCAN Potential SSH Scan" ], "sightings": 50146, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "159.223.50.175", "classifications": [], "first_seen": { "$date": "2023-03-05T00:42:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:42:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid request line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) invalid status line" ], "sightings": 20673, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "175.126.146.152", "classifications": [], "first_seen": { "$date": "2023-03-05T00:32:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:32:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81" ], "sightings": 514, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "42.113.11.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T00:51:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T00:52:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10323, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.203.11.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T01:06:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:07:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10316, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.201.134", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-03-05T01:10:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:45:20Z" }, "ports": [ 0, 5070, 1020, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 106015, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "222.186.50.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T01:14:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:02:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16518, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.212.180.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T01:23:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:17:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 114707, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.248.133.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T01:26:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:43:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T01:29:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:33:00Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 12973, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "95.254.180.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T01:30:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:31:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10291, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.243.197.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T01:40:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:13:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17202, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.118.225.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T01:41:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:11:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11354, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.91.249", "classifications": [], "first_seen": { "$date": "2023-03-05T01:38:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:38:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 510, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.99.71.79", "classifications": [], "first_seen": { "$date": "2023-03-05T01:39:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:39:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 510, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.28.238.182", "classifications": [], "first_seen": { "$date": "2023-03-05T01:39:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:08:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10610, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "157.245.109.35", "classifications": [], "first_seen": { "$date": "2023-03-05T01:41:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:36:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "ET SCAN Potential SSH Scan" ], "sightings": 26856, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "161.35.13.19", "classifications": [], "first_seen": { "$date": "2023-03-05T01:41:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:20:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 15325, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "178.128.32.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T01:42:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:43:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 84", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32631, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.72.16.162", "classifications": [], "first_seen": { "$date": "2023-03-05T01:43:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:31:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8120, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "71.32.39.116", "classifications": [], "first_seen": { "$date": "2023-03-05T01:44:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:38:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9616, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "209.159.246.20", "classifications": [], "first_seen": { "$date": "2023-03-05T01:46:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:46:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 509, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "152.69.221.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T01:56:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T01:56:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10272, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.34.110.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T01:58:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:07:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25658, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.37.43.93", "classifications": [], "first_seen": { "$date": "2023-03-05T01:48:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:24:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1518, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.13.224.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T02:00:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:26:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6149, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.119.146.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T02:00:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:28:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7003, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.84.44.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T02:01:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:01:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10265, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.199.51", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T02:18:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:13:18Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 22892, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "24.119.121.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T02:18:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:54:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11121, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.142.122.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:22:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:22:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10260, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.199.244.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T02:24:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:25:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10256, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.254.47.46", "classifications": [], "first_seen": { "$date": "2023-03-05T02:21:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:25:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 10605, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "49.12.217.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T02:30:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:45:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51194, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.234.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:34:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:34:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10253, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.183", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:38:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:50:43Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72089, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "187.188.191.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:45:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:37:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32535, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.202.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:45:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:45:21Z" }, "ports": [ 5060, 0, 1434 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 23650, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "216.218.206.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:45:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:57:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12763, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.56.32.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:47:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:47:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10247, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.115.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:50:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:50:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10246, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.251.23", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T02:51:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:20:27Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 20935, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "87.10.36.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T02:52:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:52:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10244, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.116.74.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T02:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:57:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10239, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.190.41.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T02:58:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T02:58:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10237, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.248.165.226", "classifications": [], "first_seen": { "$date": "2023-03-05T02:50:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:37:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 813, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.202.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:09:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10253, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.218.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:01:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:42:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10233, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.92", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T03:08:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:53:14Z" }, "ports": [ 22, 0, 161 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 11934, "tags": [ "alert", "tcp", "ssh", "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "192.241.200.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:15:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:59:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14469, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:17:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:17:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10221, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.197.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:25:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T21:02:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11999, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.137.20.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:20:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:15:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4179, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.84.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:31:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:01:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 99645, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.221.26.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:33:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:49:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40722, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.12.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:33:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:14:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 74457, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.56.61.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:26:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26139, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.86.39.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:27:40Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 40" ], "sightings": 95670, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.32.123.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:34:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:50:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45791, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.202.95.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:35:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:51:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50863, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.219.231.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:36:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:52:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 76264, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.4.222.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:37:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:50:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 95", "ET SCAN Potential SSH Scan" ], "sightings": 69935, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.225.14", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:40:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:31:46Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15789, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.156.18.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:41:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:37:49Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 80800, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.16.245.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:43:12Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:02:42Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 89" ], "sightings": 66027, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.14.6.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:46:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T03:57:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35526, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.73.160.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:48:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:57:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49684, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.164.74.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:50:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:32:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18332, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.132.12", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T03:52:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:54:57Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 10878, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.229.66.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T03:55:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:06:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15351, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.160.4.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T03:57:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:19:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10169, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.137.205.242", "classifications": [], "first_seen": { "$date": "2023-03-05T03:56:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:00:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 16453, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "202.87.36.138", "classifications": [], "first_seen": { "$date": "2023-03-05T03:58:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:00:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4980, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "107.170.226.23", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T04:14:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:16:07Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 23985, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "128.199.103.239", "classifications": [], "first_seen": { "$date": "2023-03-05T04:15:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:02:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25", "ET SCAN Potential SSH Scan" ], "sightings": 41074, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "112.184.240.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T04:21:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:22:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10502, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.232.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:22:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:27:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10160, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.211.62.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:22:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:22:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10141, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.177.219.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:22:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:22:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10142, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.238.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:23:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:02:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10154, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.91.79.21", "classifications": [], "first_seen": { "$date": "2023-03-05T04:30:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:30:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 83" ], "sightings": 496, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.35.124.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:31:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:31:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10131, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.208.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:32:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:32:59Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15193, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.194.23", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-05T04:34:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T15:06:19Z" }, "ports": [ 1434, 0, 1900, 22 ], "reporting_nodes": 3, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 15296, "tags": [ "udp", "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "107.170.250.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:36:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:27:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21035, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:37:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:27:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10306, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.153.0.227", "classifications": [], "first_seen": { "$date": "2023-03-05T04:33:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:50:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1484, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.25.72.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T04:36:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T02:54:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 57", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3120, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "114.34.129.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T04:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T04:46:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10124, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.99", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-05T04:49:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:03:07Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25886, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "23.122.168.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T05:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:01:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10863, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.224.30.170", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T05:10:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:11:02Z" }, "ports": [ 1723, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 15171, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.194.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:11:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:32:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16631, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.149.157.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:14:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:30:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10116, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.50.68.5", "classifications": [], "first_seen": { "$date": "2023-03-05T05:08:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:08:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 493, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.55.0.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:17:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:27:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10146, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.202", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-05T05:24:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:28:12Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 40384, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.148.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:24:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:24:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10106, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.87", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:31:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:50:30Z" }, "ports": [ 69, 0, 80 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window" ], "sightings": 15776, "tags": [ "udp", "tftp", "icmp", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.96.211.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T05:33:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:34:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10093, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:46:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:04:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18089, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.161.110.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:52:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:52:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10087, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:57:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:13:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23831, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T05:59:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T05:59:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10087, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.110.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:00:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:27:12Z" }, "ports": [ 0, 22, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SQL ping attempt" ], "sightings": 12780, "tags": [ "icmp", "alert", "tcp", "ssh", "Go", "udp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "184.105.247.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:01:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:17:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20858, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.251.154.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:02:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:02:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:04:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:44:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15710, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.155.50.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:09:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:09:58Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) method is unknown" ], "sightings": 25175, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.97.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:09:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:43:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10565, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.134.69.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T06:12:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:12:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10072, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.163.125.108", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T06:14:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:14:32Z" }, "ports": [ 705 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP AgentX/tcp request" ], "sightings": 5035, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.192.19", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:14:45Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15105, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "59.120.213.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T06:09:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:20:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 48", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4224, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "31.220.82.131", "classifications": [], "first_seen": { "$date": "2023-03-05T06:13:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:16:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 34230, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "162.243.146.10", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T06:18:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:04:52Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 12625, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.10.24.93", "classifications": [], "first_seen": { "$date": "2023-03-05T06:19:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:19:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 5034, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.156.155.14", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T06:23:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:23:11Z" }, "ports": [ 161, 22, 80 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "ET 3CORESec Poor Reputation IP group 2" ], "sightings": 5038, "tags": [ "tcp", "snmp", "alert", "ssh", "http" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.70.92.179", "classifications": [], "first_seen": { "$date": "2023-03-05T06:20:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:23:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 41446, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "103.179.57.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T06:22:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:15:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 5", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29368, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "211.20.14.156", "classifications": [], "first_seen": { "$date": "2023-03-05T06:23:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:23:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 126" ], "sightings": 487, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "179.48.124.242", "classifications": [], "first_seen": { "$date": "2023-03-05T06:25:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:25:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 86", "ET 3CORESec Poor Reputation IP group 20" ], "sightings": 974, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "148.59.74.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:44:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:44:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10061, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:48:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:27:46Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36410, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.113", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T06:48:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:29:39Z" }, "ports": [ 0, 161, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 16095, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "193.163.125.66", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T06:48:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:48:47Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 5028, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.203.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:54:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:57:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10070, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:56:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:11:33Z" }, "ports": [ 0, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack" ], "sightings": 10081, "tags": [ "icmp", "alert", "tcp", "http" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "111.239.156.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T06:56:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:56:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20109, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.231.80", "classifications": [], "first_seen": { "$date": "2023-03-05T06:48:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T06:48:20Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 72" ], "sightings": 485, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.248.161.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T07:02:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:50:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20033, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.102.78.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:06:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:07:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 61" ], "sightings": 10057, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "154.221.30.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:09:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:27:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45061, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "52.174.28.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:09:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:26:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50092, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.181.143.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:11:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:26:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45076, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.21.145.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:13:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:26:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55081, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.148.122.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T07:13:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:25:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33101, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2620:002d:4000:0001:0000:0000:0000:002b", "classifications": [], "first_seen": { "$date": "2023-03-05T07:03:51Z" }, "ja3": [ "e0ff89ed9185dfb09184797a4c3f2e1c" ], "last_seen": { "$date": "2023-03-05T07:03:51Z" }, "ports": [ 40352, 46454 ], "reporting_nodes": 1, "rules": [], "sightings": 504, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.134.176.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:09:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:19:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52556, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.146.158.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:09:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:38:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35680, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.246.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:15:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:15:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10032, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.222.108.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:16:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:31:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50010, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.225.154.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:19:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:31:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49982, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.19.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:21:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:33:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 98", "ET SCAN Potential SSH Scan" ], "sightings": 71715, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.114.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T07:21:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:51:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19504, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.242.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:26:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:46:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63284, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.11.165", "classifications": [], "first_seen": { "$date": "2023-03-05T07:18:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:18:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 58" ], "sightings": 483, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.90.88.78", "classifications": [], "first_seen": { "$date": "2023-03-05T07:28:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:28:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 483, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "216.172.165.15", "classifications": [], "first_seen": { "$date": "2023-03-05T07:31:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:31:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 130" ], "sightings": 483, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.35.75.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T07:39:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:40:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9986, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.219.144.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T07:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:43:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.98.11.87", "classifications": [], "first_seen": { "$date": "2023-03-05T07:33:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:06:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 9193, "tags": [ "ssh", "tcp", "ssh", "Go", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "64.62.197.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T08:00:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:15:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11652, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.215.29.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:00:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:15:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 162" ], "sightings": 29949, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.229.251.22", "classifications": [], "first_seen": { "$date": "2023-03-05T07:51:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T07:51:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 481, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "143.198.200.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:00:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:07:53Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 45" ], "sightings": 23943, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.128.32.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:18:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29938, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.176.79.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:03:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:40:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 113959, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.106.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T08:05:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:52:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11270, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.189.86.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:05:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:19:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39783, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.255.93.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:09:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:23:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 86862, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T08:09:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T15:15:37Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 18012, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "121.185.206.10", "classifications": [], "first_seen": { "$date": "2023-03-05T08:04:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:04:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 480, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "128.199.100.123", "classifications": [], "first_seen": { "$date": "2023-03-05T08:09:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:04:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 10015, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "142.93.194.227", "classifications": [], "first_seen": { "$date": "2023-03-05T08:10:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:55:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 10039, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.17.3.115", "classifications": [], "first_seen": { "$date": "2023-03-05T08:11:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:51:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 14332, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "202.137.26.4", "classifications": [], "first_seen": { "$date": "2023-03-05T08:11:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:08:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 117", "ET SCAN Potential SSH Scan" ], "sightings": 26461, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "188.169.61.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T08:18:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:18:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9945, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.229.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T08:24:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:47:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13384, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.70.115.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:28:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:03:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 289083, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.208.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T08:31:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:16:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13335, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.28.109.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:35:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:50:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44586, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.220.190.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:37:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:37:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9922, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.189", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-05T08:38:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:22:40Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 32642, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "220.134.25.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T08:43:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:43:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9917, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.50.128.171", "classifications": [], "first_seen": { "$date": "2023-03-05T08:44:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:46:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 10017, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "167.94.146.71", "classifications": [], "first_seen": { "$date": "2023-03-05T08:47:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:47:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 18" ], "sightings": 476, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.94.146.59", "classifications": [], "first_seen": { "$date": "2023-03-05T08:47:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T08:47:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 18", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1428, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "91.232.225.64", "classifications": [], "first_seen": { "$date": "2023-03-05T08:59:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:03:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA STREAM 3way handshake SYN resend different seq on SYN recv", "SURICATA STREAM ESTABLISHED SYN resend with different seq" ], "sightings": 75975, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "157.230.33.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:02:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:15:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39446, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "140.99.219.26", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-05T09:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:14:01Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29585, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "179.57.50.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T09:10:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:10:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 24654, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "185.200.118.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T09:16:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:27:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19701, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.192.124.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T09:21:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:21:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9853, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.186.99.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:26:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:37:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29543, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.36.15.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:20:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:59:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28362, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.105.32.233", "classifications": [], "first_seen": { "$date": "2023-03-05T09:24:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:24:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 469, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "121.183.220.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:30:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:31:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9850, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.189.116.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:31:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:51:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51550, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "196.220.67.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:31:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:14:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29624, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.117.169.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T09:35:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:35:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9845, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T09:42:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:10:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17443, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.165.22.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:46:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:00:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 29448, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.39.99.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:46:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:55:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 59494, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.141.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:48:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:39:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56959, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.250.4.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T09:49:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:02:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 88121, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T09:53:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:08:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9856, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.80.20.86", "classifications": [], "first_seen": { "$date": "2023-03-05T09:53:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T09:53:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 64", "ET 3CORESec Poor Reputation IP group 41" ], "sightings": 1868, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "64.62.197.193", "classifications": [ "Misc activity", "Potentially Bad Traffic", "Attempted Information Leak", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-05T10:01:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:09:09Z" }, "ports": [ 0, 69, 177, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "X11 xdmcp info query", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 68334, "tags": [ "icmp", "udp", "tftp", "xdmcp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 4 }, { "ioc": "87.98.234.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T10:02:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T17:11:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19009, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.0.218.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T10:14:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:06:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33508, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.228.99.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T10:14:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:15:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 10679, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "2a05:d018:091c:3200:5e0d:21a9:26ca:90b5", "classifications": [], "first_seen": { "$date": "2023-03-05T10:04:18Z" }, "ja3": [ "fb4726d465c5f28b84cd6d14cedd13a7" ], "last_seen": { "$date": "2023-06-30T03:27:16Z" }, "ports": [ 55324, 43388, 41224, 58686, 60362, 60032, 39968, 39168 ], "reporting_nodes": 1, "rules": [], "sightings": 624, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "139.0.22.6", "classifications": [], "first_seen": { "$date": "2023-03-05T10:09:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:30:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 36182, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "112.5.88.63", "classifications": [], "first_seen": { "$date": "2023-03-05T10:16:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:17:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 2330, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.254.215.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T10:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:32:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48858, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.88.245.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T10:18:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:18:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9783, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.6.126.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T10:19:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:19:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9782, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "110.141.195.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T10:36:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:11:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18470, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.168.125.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T10:40:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:09:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 91" ], "sightings": 42935, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.248.162.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T10:41:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:51:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34174, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.49.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T10:42:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:54:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48807, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.86.117.132", "classifications": [], "first_seen": { "$date": "2023-03-05T10:32:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:24:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 10184, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.134.255.226", "classifications": [], "first_seen": { "$date": "2023-03-05T10:34:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T10:46:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3248, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "142.93.102.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T10:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:41:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 45759, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.153", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-05T10:53:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T11:14:31Z" }, "ports": [ 0, 80, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-TFTP Get" ], "sightings": 14670, "tags": [ "icmp", "alert", "tcp", "http", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "159.223.107.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T10:55:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:30:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11623, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.116.40.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T11:00:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:00:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9755, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.141.14", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T11:07:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:07:21Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19491, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.232.30", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T11:08:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:08:39Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19490, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.111.224.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T11:14:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:14:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.169.128.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T11:19:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:19:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9737, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.48", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-05T11:23:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:27:53Z" }, "ports": [ 0, 111 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 11011, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "74.82.47.57", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T11:27:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:29:57Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14615, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "62.152.38.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T11:29:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:29:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9736, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.121.81.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T11:30:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:32:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9732, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.169.76.9", "classifications": [], "first_seen": { "$date": "2023-03-05T11:32:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:26:14Z" }, "ports": [ 443, 81 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 6223, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.53.132.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T11:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:37:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9732, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.142.156.238", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T11:40:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:16:21Z" }, "ports": [ 0, 53, 161, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 311855, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "36.38.21.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T11:40:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:41:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9724, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.168.16.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T11:33:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:11:30Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 17", "ET SCAN Potential SSH Scan", "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 4502, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "146.19.169.228", "classifications": [], "first_seen": { "$date": "2023-03-05T11:42:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:45:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 39100, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "87.236.176.19", "classifications": [], "first_seen": { "$date": "2023-03-05T11:58:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T11:58:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 4857, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.64.185.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T11:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:12:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24261, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.248.12.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T11:47:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:43:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1150, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.95.146.70", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T12:08:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:15:57Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 75039, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.230.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T12:14:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:14:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9706, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.155.127.110", "classifications": [], "first_seen": { "$date": "2023-03-05T12:14:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:14:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "SURICATA TCPv4 invalid checksum" ], "sightings": 5714, "tags": [ "tcp", "ssh", "alert", "OpenSSH" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "104.42.148.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:10:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:19:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41147, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.53.228.192", "classifications": [], "first_seen": { "$date": "2023-03-05T12:11:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:11:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 458, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.77.194.67", "classifications": [], "first_seen": { "$date": "2023-03-05T12:11:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:03:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 165", "ET SCAN Potential SSH Scan" ], "sightings": 23281, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.101.49.191", "classifications": [], "first_seen": { "$date": "2023-03-05T12:12:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:01:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 160", "ET SCAN Potential SSH Scan" ], "sightings": 22824, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "121.188.160.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:13:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:21:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4799, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.117.237.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:15:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:53:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7632, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.113.11.140", "classifications": [], "first_seen": { "$date": "2023-03-05T12:15:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:17:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 13649, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "182.75.75.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T12:19:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:47:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19275, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.250.11", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T12:26:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:17:06Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 18489, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.163.199.170", "classifications": [], "first_seen": { "$date": "2023-03-05T12:30:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:46:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1854, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.5.209.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:30:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:47:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38716, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.12.121.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:31:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:43:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 110", "ET SCAN Potential SSH Scan" ], "sightings": 44328, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.179.28.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:32:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:45:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40381, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.75.183.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:33:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:11:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 45984, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.17.229.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:40:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:53:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38661, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.105.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:41:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:54:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48324, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.189.30.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T12:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:54:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43499, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.32.157.177", "classifications": [], "first_seen": { "$date": "2023-03-05T12:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T12:46:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 81" ], "sightings": 910, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.117.89.118", "classifications": [], "first_seen": { "$date": "2023-03-05T13:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:04:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 20402, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "220.93.133.100", "classifications": [], "first_seen": { "$date": "2023-03-05T13:02:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:02:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 906, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.227.136.107", "classifications": [], "first_seen": { "$date": "2023-03-05T13:11:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:16:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 34428, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "113.6.251.235", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T13:20:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:20:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 24126, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.99.126.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:21:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:34:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38559, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.168.96.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:22:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:19:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 196918, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.250.209", "classifications": [], "first_seen": { "$date": "2023-03-05T13:22:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:27:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 39749, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "43.156.47.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:30:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:22:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5661, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.156.145.28", "classifications": [], "first_seen": { "$date": "2023-03-05T13:31:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:17:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 34", "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 4371, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "83.13.153.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:31:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:33:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9637, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.158.124.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:34:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:34:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9914, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "156.205.4.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T13:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:41:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9637, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.197.176.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:32:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:57:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35", "ET 3CORESec Poor Reputation IP group 12", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43563, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "43.153.36.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:04:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24728, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.40.73.192", "classifications": [], "first_seen": { "$date": "2023-03-05T13:34:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:34:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120" ], "sightings": 450, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.135.198.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:52:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:53:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9626, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.16.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:57:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:21:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38415, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "227.192.19.141", "classifications": [], "first_seen": { "$date": "2023-03-05T13:58:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:58:56Z" }, "ports": [ 47955 ], "reporting_nodes": 1, "rules": [ "(ipv4) IPv4 packet from multicast source address" ], "sightings": 4812, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "50.193.220.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:52:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:57:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 162", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7904, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.236.41.248", "classifications": [], "first_seen": { "$date": "2023-03-05T13:54:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:13:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 17033, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "194.204.194.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T13:54:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:59:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 107", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 7670, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "82.130.209.51", "classifications": [], "first_seen": { "$date": "2023-03-05T13:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T13:56:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 181" ], "sightings": 449, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.43.136.72", "classifications": [], "first_seen": { "$date": "2023-03-05T13:57:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:57:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 4921, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "170.210.46.4", "classifications": [], "first_seen": { "$date": "2023-03-05T13:57:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:33:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6616, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.138.27.12", "classifications": [], "first_seen": { "$date": "2023-03-05T14:10:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:14:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 12992, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "193.123.123.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T14:17:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:47:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31165, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.96.57", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T14:23:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:23:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14388, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "170.106.115.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T14:28:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T14:26:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25481, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.35.18.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T14:35:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:35:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.242.65.12", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T14:37:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:21:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 47276, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.254.241.127", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T14:40:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:53:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 73331, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.118.113.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T14:40:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:42:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9572, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.21.17.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T14:40:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:40:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.148.238.220", "classifications": [], "first_seen": { "$date": "2023-03-05T14:44:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:44:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 446, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "51.79.240.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T14:47:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:57:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 59762, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.60.47.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T14:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:11:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 141593, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.171.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T14:58:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:09:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 39989, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "70.88.3.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T14:58:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:11:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 176", "ET SCAN Potential SSH Scan" ], "sightings": 52413, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "211.227.213.124", "classifications": [], "first_seen": { "$date": "2023-03-05T14:52:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T14:52:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 475, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "95.229.113.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:00:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:01:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9562, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "145.239.205.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T15:04:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:04:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9557, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.118.55.166", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic", "Detection of a Network Scan", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-05T15:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:26:51Z" }, "ports": [ 0, 1434, 161, 69, 1900, 111 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 435471, "tags": [ "icmp", "udp", "snmp", "tftp", "sunrpc", "portmapper" ], "rule_count": 10, "classification_count": 5 }, { "ioc": "194.233.82.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:11:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:29:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42717, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.179.20.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:12:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:01:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5774, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.118.55.163", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T15:12:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:13:42Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 52405, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "193.118.55.162", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T15:12:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:13:42Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 52399, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "162.243.147.22", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T15:15:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:52:24Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 23810, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.153.170.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:15:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:26:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37975, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.240.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T15:16:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:30:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22020, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.188.12.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T15:18:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:18:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9509, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.137.74.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:18:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:19:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13137, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.244.63.127", "classifications": [], "first_seen": { "$date": "2023-03-05T15:19:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:19:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 9506, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "80.94.93.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T15:22:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:09:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18902, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.42.73.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:25:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:26:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 14220, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.208.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T15:27:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:09:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9494, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.15.11.227", "classifications": [], "first_seen": { "$date": "2023-03-05T15:27:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:27:34Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 9475, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.233.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T15:29:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:59:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18860, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.66.131.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:20:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:13:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 32", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 495, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.128.16", "classifications": [], "first_seen": { "$date": "2023-03-05T15:21:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:21:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61" ], "sightings": 443, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.179.57.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:21:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 5", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24654, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.242.126", "classifications": [], "first_seen": { "$date": "2023-03-05T15:21:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:36:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3541, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.101.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:24:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:15:46Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 33186, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.101.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T15:38:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:59:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19094, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.98.11.144", "classifications": [], "first_seen": { "$date": "2023-03-05T15:41:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:21:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 138532, "tags": [ "tcp", "brute_force", "ssh", "alert", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.236.50", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T15:48:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:48:52Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 20259, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "121.144.34.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:52:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:52:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9453, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.150.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:52:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:40:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25" ], "sightings": 140913, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.255.31.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T15:55:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:33:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 80435, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.140.156.108", "classifications": [], "first_seen": { "$date": "2023-03-05T15:49:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T15:49:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 441, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "23.94.123.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T16:05:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:51:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16239, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.95.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T16:08:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:52:51Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9416, "tags": [ "icmp", "ssh", "tcp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.60.37.204", "classifications": [], "first_seen": { "$date": "2023-03-05T16:22:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:22:38Z" }, "ports": [ 8088 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 9400, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "115.219.150.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T16:24:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T16:24:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9398, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.224.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T16:52:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:21:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9391, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.210.66.91", "classifications": [], "first_seen": { "$date": "2023-03-05T16:49:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:07:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 756, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.241.222.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T17:01:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T17:01:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9385, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.159.49.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:19:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:52:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37629, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.31.53.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:19:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:44:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39451, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.189.223.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:19:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:27:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52496, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.110.84.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:20:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:21:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37623, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.133.62.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:21:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T17:32:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32793, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.78.142.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:22:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:19:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 130363, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.134.74.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:26:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T17:26:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4688, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.129.40.155", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-05T17:34:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:35:18Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP Get" ], "sightings": 52022, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.122.197.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:35:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:32:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42318, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.163.217.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:36:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:09:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48189, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.111.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:37:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T17:51:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46609, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.57.0.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:38:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T17:38:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum" ], "sightings": 9522, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.55.66.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:41:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T17:41:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9331, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "102.218.10.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T17:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:02:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41860, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T17:54:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:34:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20231, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.74.16.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T17:55:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:58:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42027, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.18.222.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T18:03:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:04:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9290, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.131.10.103", "classifications": [], "first_seen": { "$date": "2023-03-05T18:06:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:06:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 86" ], "sightings": 431, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.239.9", "classifications": [], "first_seen": { "$date": "2023-03-05T18:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:09:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 862, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "67.207.85.118", "classifications": [], "first_seen": { "$date": "2023-03-05T18:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:11:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174" ], "sightings": 431, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "36.27.120.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T18:27:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:27:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.54.76", "classifications": [], "first_seen": { "$date": "2023-03-05T18:22:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:18:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153", "ET SCAN Potential SSH Scan" ], "sightings": 22256, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "91.66.4.163", "classifications": [], "first_seen": { "$date": "2023-03-05T18:22:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:22:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187" ], "sightings": 430, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.157.10.111", "classifications": [], "first_seen": { "$date": "2023-03-05T18:25:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:25:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153" ], "sightings": 430, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.198.77.231", "classifications": [], "first_seen": { "$date": "2023-03-05T18:27:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:27:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 46" ], "sightings": 430, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.147.56", "classifications": [], "first_seen": { "$date": "2023-03-05T18:27:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:20:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25", "ET SCAN Potential SSH Scan" ], "sightings": 22249, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.61.185.107", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T18:41:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:44:33Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 83326, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.122.10.17", "classifications": [], "first_seen": { "$date": "2023-03-05T18:41:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T18:44:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 3003, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.92.108.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T18:55:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:58:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52732, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.193.102.229", "classifications": [], "first_seen": { "$date": "2023-03-05T18:52:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:08:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 39556, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "122.10.246.240", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T19:07:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:47:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 92496, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "118.151.209.226", "classifications": [], "first_seen": { "$date": "2023-03-05T19:03:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:06:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 9387, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "60.28.193.56", "classifications": [], "first_seen": { "$date": "2023-03-05T19:04:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:45:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 12306, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "143.198.60.41", "classifications": [], "first_seen": { "$date": "2023-03-05T19:04:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:04:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 46" ], "sightings": 426, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "178.62.97.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:05:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:19:04Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 85", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7519, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.255.91.13", "classifications": [], "first_seen": { "$date": "2023-03-05T19:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T20:01:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8055, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.9.36.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:08:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:20:37Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25122, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.249.117.187", "classifications": [], "first_seen": { "$date": "2023-03-05T19:09:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:15:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1277, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "120.204.196.162", "classifications": [], "first_seen": { "$date": "2023-03-05T19:13:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:34:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1858, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T19:16:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:50:40Z" }, "ports": [ 0, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 10593, "tags": [ "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "14.180.209.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:23:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:25:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9259, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.49.197.164", "classifications": [], "first_seen": { "$date": "2023-03-05T19:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:26:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 424, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.218.49.211", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-03-05T19:31:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:36:26Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 72954, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "80.242.210.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:33:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:49:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46160, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "213.225.9.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:33:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:47:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36950, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.33.250.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:35:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:47:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41560, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.250.47.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:36:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:45:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27718, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.214.231.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T19:37:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T22:48:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10269, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.199.146.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:38:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:04:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10091, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.112.79.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:39:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:56:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48548, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.114.254.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:40:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:55:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36866, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.38.113.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:58:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50649, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.43.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T19:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:51:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36880, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.236.40", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T19:47:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:19:17Z" }, "ports": [ 1434, 0, 53 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 14199, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.192.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T19:48:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:48:53Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13821, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "186.108.203.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T19:48:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:48:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9216, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.64.210.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T19:58:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T19:58:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27581, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.9.63.138", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T20:00:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:34:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 84408, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.37.81.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T20:05:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:34:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6308, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.112.16.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T20:07:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:40:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10193, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.121.4.21", "classifications": [], "first_seen": { "$date": "2023-03-05T20:15:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T20:29:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA STREAM Packet with invalid timestamp", "SURICATA STREAM FIN out of window" ], "sightings": 23141, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 7, "classification_count": 0 }, { "ioc": "182.162.17.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T20:20:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:32:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13360, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.93.132.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T20:28:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T20:28:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9169, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.37.108.146", "classifications": [], "first_seen": { "$date": "2023-03-05T20:29:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T20:29:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 4584, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.138.36.13", "classifications": [], "first_seen": { "$date": "2023-03-05T20:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T20:32:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 26880, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "121.206.155.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T20:34:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T20:34:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9157, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.36.22.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T20:44:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:43:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24276, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.55.247.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T20:47:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:35:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 113", "ET 3CORESec Poor Reputation IP group 26", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 962, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "221.158.35.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T20:50:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T20:50:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9150, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.105.61.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T20:54:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T20:54:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9149, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.19.168.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T21:00:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:00:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9147, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.226.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T21:05:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:28:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9148, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.117.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T21:05:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:16:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9664, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.91.0.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:08:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:35:05Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 138", "ET SCAN Potential SSH Scan" ], "sightings": 96283, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "86.157.216.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:10:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:08:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 160391, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.248.165.66", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T21:11:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:53:27Z" }, "ports": [ 162, 2935, 61098, 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp", "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 21609, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "154.89.5.110", "classifications": [], "first_seen": { "$date": "2023-03-05T21:07:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:10:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1251, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.199.53.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:18:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:18:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9133, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.64.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:19:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:35:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41014, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.21.71.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T21:25:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:25:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 9130, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.239.247.241", "classifications": [], "first_seen": { "$date": "2023-03-05T21:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:32:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1664, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.142.125.222", "classifications": [], "first_seen": { "$date": "2023-03-05T21:27:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:27:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 832, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.224.155.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:39:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:51:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40895, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.146.158.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:40:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:56:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40858, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.175.118.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:41:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:04:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 112379, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.144.44.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T21:44:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:44:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9099, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.216.251.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T21:44:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:44:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 9097, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.221.243.20", "classifications": [], "first_seen": { "$date": "2023-03-05T21:38:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:21:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 9114, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "60.250.228.49", "classifications": [], "first_seen": { "$date": "2023-03-05T21:46:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:46:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 60" ], "sightings": 830, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.200.116.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T21:50:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:57:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18148, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.208.63.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T21:50:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T21:50:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.221.16.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:51:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:07:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36238, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.65.239.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T21:53:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:23:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 108397, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.212.177.113", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T21:57:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:22:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 32548, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.243.135.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T22:03:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:27:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9997, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.94.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T22:04:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:21:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10547, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.168.41.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:04:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:04:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9387, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.126.161.16", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-05T22:05:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:48:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 78664, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "4.224.22.134", "classifications": [], "first_seen": { "$date": "2023-03-05T22:11:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:13:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 26432, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "96.66.97.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:14:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:24:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 91", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5159, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.238.12", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-05T22:16:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:18:16Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 9928, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.194.78.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:28:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:08:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 43626, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.35.9", "classifications": [], "first_seen": { "$date": "2023-03-05T22:20:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:09:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 64", "ET SCAN Potential SSH Scan" ], "sightings": 20531, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "64.225.108.130", "classifications": [], "first_seen": { "$date": "2023-03-05T22:20:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:10:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 66", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 171", "ET SCAN Potential SSH Scan" ], "sightings": 20940, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "221.149.93.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:25:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:13:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 535, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.158.57", "classifications": [], "first_seen": { "$date": "2023-03-05T22:29:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:33:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 18535, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "167.71.54.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:36:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:51:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44803, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.28.22.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:53:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52106, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.194.74.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:55:41Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 24" ], "sightings": 59182, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.69.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:38:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:16:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 133447, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.180.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:38:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:52:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49242, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "150.230.235.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:38:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:46:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13474, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.55.62.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:18:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 143242, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.161.125.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:39:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:30:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 136654, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.175.4.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T22:40:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 106677, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.229.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T22:42:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:42:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8989, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T22:45:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:45:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8974, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T22:53:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T22:53:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8916, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.134.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T22:53:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:42:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13633, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.93.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T22:54:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:05:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8921, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T23:03:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:03:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8885, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.131.39.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:14:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:38:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39845, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.65.186.116", "classifications": [], "first_seen": { "$date": "2023-03-05T23:12:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:15:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 28558, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "23.13.164.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T23:19:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:19:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8849, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.248.6.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T23:25:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:52:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 364997, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.215.56.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T23:27:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:27:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8844, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.148.213.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T23:28:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:28:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8842, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.233.235", "classifications": [], "first_seen": { "$date": "2023-03-05T23:26:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:24:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 69", "ET SCAN Potential SSH Scan" ], "sightings": 17782, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "52.129.118.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:28:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:57:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33842, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.242.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:29:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:37:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16348, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.100.226.111", "classifications": [], "first_seen": { "$date": "2023-03-05T23:29:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:29:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 406, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "172.81.129.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T23:36:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:36:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Timestamp Request", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP Timestamp Reply" ], "sightings": 39757, "tags": [ "icmp" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "124.222.10.213", "classifications": [], "first_seen": { "$date": "2023-03-05T23:43:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:00:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 44125, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "192.241.222.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T23:49:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:39:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13995, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.12.122.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:53:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:10:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48443, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.128.76.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:56:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4413, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.139.58.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:57:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:44:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 131704, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.223.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-05T23:59:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T18:08:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8827, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.187.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:59:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:34:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39664, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.214.1.10", "classifications": [], "first_seen": { "$date": "2023-03-05T23:50:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:50:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 699, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "209.141.57.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:51:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:57:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 125", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31833, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.227.176.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:52:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:38:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7676, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.152.52.215", "classifications": [], "first_seen": { "$date": "2023-03-05T23:54:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-05T23:54:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 404, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.153.211.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-05T23:54:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T23:20:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9332, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.124.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T00:02:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:51:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17515, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.210.22.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T00:02:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:02:18Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) method is unknown" ], "sightings": 22039, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "118.194.253.72", "classifications": [], "first_seen": { "$date": "2023-03-06T00:03:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:03:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "invalid_banner", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 6280, "tags": [ "tcp", "brute_force", "ssh", "alert", "anomaly", "Go", "Server" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "222.103.20.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T00:06:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:48:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 845, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "156.59.219.41", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T00:19:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:41:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 105355, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "216.218.206.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T00:25:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:00:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17235, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.28", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-06T00:33:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:30:17Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 24170, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.228.22.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T00:34:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:35:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8779, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.132.126.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T00:38:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:38:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8780, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.202.190.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T00:38:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:38:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8777, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.28.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T00:40:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:54:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35060, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.54.108.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T00:41:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:41:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4388, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.145.53.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T00:41:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:53:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35066, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.170.129.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T00:43:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:54:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120", "ET 3CORESec Poor Reputation IP group 27" ], "sightings": 35073, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.144.158.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T00:46:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:03:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17464, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T00:50:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T00:50:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8762, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.226.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T00:55:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:14:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18738, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.211.116.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T01:00:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:43:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4886, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.116.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T01:05:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:01:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31089, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.185.25.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T01:05:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:08:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8753, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.202.190.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T01:06:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:06:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8743, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.232.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T01:09:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:34:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44710, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.229.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T01:10:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:48:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 69289, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.176.145.43", "classifications": [], "first_seen": { "$date": "2023-03-06T01:09:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:09:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 21" ], "sightings": 399, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.255.28.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T01:09:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:48:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4707, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.8.145.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T01:17:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:17:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8725, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.82.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T01:22:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:23:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8723, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.108", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T01:25:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:18:42Z" }, "ports": [ 0, 1434, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 14944, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "125.212.218.63", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T01:35:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:30:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37687, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.117.11.213", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T01:39:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:29:24Z" }, "ports": [ 0, 53, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 1131773, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "5.63.151.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T01:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:43:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8705, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.21.10.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T01:50:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T01:51:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8697, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.110", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T01:54:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:45:30Z" }, "ports": [ 69, 0, 177 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 37880, "tags": [ "udp", "tftp", "icmp", "xdmcp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "180.115.246.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T02:07:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:07:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8693, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.90.229.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T02:12:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:31:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17348, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.136.51.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T02:14:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:14:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8693, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.71.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T02:25:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:35:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39326, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T02:29:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:12:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32289, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.49.81.249", "classifications": [], "first_seen": { "$date": "2023-03-06T02:20:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:25:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 11892, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "103.92.24.243", "classifications": [], "first_seen": { "$date": "2023-03-06T02:28:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:28:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 9" ], "sightings": 393, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.63.151.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T02:35:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:35:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8685, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.134.212.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T02:41:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:24:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14279, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.224.109.122", "classifications": [], "first_seen": { "$date": "2023-03-06T02:44:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:44:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 392, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "146.185.25.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T02:52:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T02:52:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8670, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T02:54:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:06:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T03:06:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:06:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.51.246", "classifications": [], "first_seen": { "$date": "2023-03-06T03:08:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:08:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12", "ET 3CORESec Poor Reputation IP group 3", "ET SCAN Potential SSH Scan" ], "sightings": 2349, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "101.43.56.68", "classifications": [], "first_seen": { "$date": "2023-03-06T03:09:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:26:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 22992, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "161.35.79.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T03:10:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:07:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 64", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40107, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "175.119.79.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T03:10:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:34:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27351, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.69.77.88", "classifications": [], "first_seen": { "$date": "2023-03-06T03:11:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:54:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 20" ], "sightings": 23940, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "38.242.245.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T03:23:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:23:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8657, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.134.144.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T03:34:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:22:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 218137, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.106.123.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T03:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:36:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8654, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.96.184.208", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-06T03:38:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:50:21Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 267631, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "201.142.130.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T03:42:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:43:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8647, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "145.239.90.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T03:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:07:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 48", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 47169, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "83.229.82.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T03:52:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:52:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8642, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T03:54:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:54:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8644, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T03:55:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:55:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8641, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.255.84.22", "classifications": [], "first_seen": { "$date": "2023-03-06T03:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:03:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3079, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "109.230.196.3", "classifications": [], "first_seen": { "$date": "2023-03-06T03:49:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:42:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8445, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "37.120.239.34", "classifications": [], "first_seen": { "$date": "2023-03-06T03:49:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:36:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 7683, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "84.52.103.234", "classifications": [], "first_seen": { "$date": "2023-03-06T03:50:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:04:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 4234, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.55.221.225", "classifications": [], "first_seen": { "$date": "2023-03-06T03:50:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:29:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 11520, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "1.116.214.66", "classifications": [], "first_seen": { "$date": "2023-03-06T03:52:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T03:56:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 13090, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "45.128.232.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T04:02:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:10:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 170023, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.254.245.116", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T04:06:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:08:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 58513, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "60.48.47.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:10:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:10:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8632, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.0.71.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:10:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:27:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 161", "ET SCAN Potential SSH Scan" ], "sightings": 36346, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "207.249.96.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:11:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:30:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43080, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.63.151.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T04:14:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:14:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8628, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.167.79.207", "classifications": [], "first_seen": { "$date": "2023-03-06T04:17:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:17:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 389, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.88.225.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:18:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:42:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12920, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.139.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T04:19:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:19:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8624, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.238.139.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:21:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:22:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8620, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.227.140.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:23:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:23:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8617, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.244.104.152", "classifications": [], "first_seen": { "$date": "2023-03-06T04:27:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:27:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 383, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "88.202.190.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T04:30:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:30:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.123.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:42:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:43:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8605, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.79.142.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:43:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34390, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "173.13.74.99", "classifications": [], "first_seen": { "$date": "2023-03-06T04:41:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:41:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1146, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "171.96.174.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:45:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:04:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8922, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.210.23.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T04:48:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:48:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8604, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.11.149.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T04:57:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T04:57:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8600, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.182.168.210", "classifications": [], "first_seen": { "$date": "2023-03-06T04:58:41Z" }, "ja3": [ "19e29534fd49dd27d09234e639c4057e" ], "last_seen": { "$date": "2023-03-06T04:58:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "REQUEST_BODY_UNEXPECTED", "SURICATA HTTP Unexpected Request body" ], "sightings": 2286, "tags": [ "alert", "tcp", "ssh", "anomaly", "tls", "http" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "194.195.221.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T05:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:21:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16418, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.53.238.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:08:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:09:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8590, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.194.11.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T05:13:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:13:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.164.218.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:17:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:25:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8306, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.202.190.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T05:16:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:16:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8587, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.26", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-06T05:19:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:30:12Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 8592, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "2.57.122.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T05:19:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T02:55:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13536, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.153.254.103", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T05:23:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:00:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 55866, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "172.105.21.200", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T05:23:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:22:16Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33802, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "222.109.124.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:24:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:25:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8584, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.144", "classifications": [], "first_seen": { "$date": "2023-03-06T05:37:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:38:37Z" }, "ports": [ 56725, 17886 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 8581, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.43.30.56", "classifications": [], "first_seen": { "$date": "2023-03-06T05:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:51:07Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected", "(stream_tcp) reset outside window" ], "sightings": 141103, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "157.230.47.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:45:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:58:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34222, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.214.223.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:58:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25676, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.229.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T05:53:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:53:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8556, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.189.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:53:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:07:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34158, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.36.123.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:53:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:07:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38422, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.196.62.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:55:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:17:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 169855, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.29", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T05:56:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:27:12Z" }, "ports": [ 0, 161, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 23960, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "193.243.159.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:56:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:07:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46172, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "141.148.135.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T05:57:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:08:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21347, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "2.236.98.36", "classifications": [], "first_seen": { "$date": "2023-03-06T05:59:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T05:59:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 4" ], "sightings": 377, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:31:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11923, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.202.16.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T06:12:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:27:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33991, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.44.244.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T06:14:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:13:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34015, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.3.147.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T06:15:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:00:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 126876, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.218.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:15:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:48:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.197.197.225", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T06:18:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:19:13Z" }, "ports": [ 110, 162, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 12763, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.219.235.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:19:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:19:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8509, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "226.232.210.83", "classifications": [], "first_seen": { "$date": "2023-03-06T06:20:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:20:55Z" }, "ports": [ 53134 ], "reporting_nodes": 1, "rules": [ "(ipv4) IPv4 packet from multicast source address" ], "sightings": 8503, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.111.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T06:20:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:31:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29680, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "106.52.106.191", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:21:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:20:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 150416, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.6.233.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:28:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:28:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8475, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:29:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:29:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8472, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.214.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:29:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:11:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.156.73.53", "classifications": [], "first_seen": { "$date": "2023-03-06T06:28:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:28:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 375, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "155.94.134.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:32:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:32:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8467, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:40:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:40:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8462, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.16.245.85", "classifications": [], "first_seen": { "$date": "2023-03-06T06:36:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:34:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 89", "ET SCAN Potential SSH Scan" ], "sightings": 14859, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "143.42.61.49", "classifications": [], "first_seen": { "$date": "2023-03-06T06:36:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:27:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 7808, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.49.50.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T06:38:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:26:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15039, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.187.3.61", "classifications": [], "first_seen": { "$date": "2023-03-06T06:42:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:42:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 373, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.241.212.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:45:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:04:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.253.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T06:46:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:24:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38026, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.123.117.236", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-06T06:49:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:26:17Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 21090, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.142.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:52:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:21:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.93", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-06T06:53:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T07:51:40Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 21614, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.106.115.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T06:58:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:58:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8449, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.156.73.121", "classifications": [], "first_seen": { "$date": "2023-03-06T06:54:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T06:54:05Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 372, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "94.207.64.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:01:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8446, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.221.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:02:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:08:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19171, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:03:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:03:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8440, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:07:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:58:11Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20954, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "89.248.165.84", "classifications": [], "first_seen": { "$date": "2023-03-06T07:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:12:11Z" }, "ports": [ 3340, 8989, 80 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 8772, "tags": [ "tcp", "alert", "http" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.201.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:11:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:11:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8440, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.106.122.123", "classifications": [], "first_seen": { "$date": "2023-03-06T07:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:55:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 4425, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "94.23.162.147", "classifications": [], "first_seen": { "$date": "2023-03-06T07:10:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:58:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8819, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.152.237.118", "classifications": [], "first_seen": { "$date": "2023-03-06T07:10:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:02:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 7723, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.132.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T07:10:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T20:51:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22511, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.131.27.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T07:10:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:14:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13527, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.205.187.133", "classifications": [], "first_seen": { "$date": "2023-03-06T07:11:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:11:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174" ], "sightings": 371, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.183.137.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T07:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:25:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47921, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.124.24.238", "classifications": [], "first_seen": { "$date": "2023-03-06T07:13:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:26:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2586, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "112.64.33.38", "classifications": [], "first_seen": { "$date": "2023-03-06T07:16:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:16:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1110, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "216.218.206.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:06:07Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 18914, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.234.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:19:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:19:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.30.68.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T07:21:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:12:22Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4824, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.145.254.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T07:21:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:57:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34447, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "88.202.190.156", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:21:53Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12648, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "183.251.232.126", "classifications": [], "first_seen": { "$date": "2023-03-06T07:24:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:25:06Z" }, "ports": [ 53843, 56779, 7059, 659, 18853, 23557, 45344, 10212, 38965, 42088 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 18530, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "216.218.206.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:24:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:20:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28574, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.177.200.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:25:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:02:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15922, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.195.221.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:29:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:12:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16550, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "40.70.0.187", "classifications": [], "first_seen": { "$date": "2023-03-06T07:21:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:18:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 142", "ET SCAN Potential SSH Scan" ], "sightings": 18298, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.89.164.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T07:23:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:55:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 166", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23377, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "111.62.70.154", "classifications": [], "first_seen": { "$date": "2023-03-06T07:23:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:37:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 1474, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.99.5.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T07:26:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 77", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8009, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.143.96.74", "classifications": [], "first_seen": { "$date": "2023-03-06T07:27:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:32:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 5904, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "71.6.233.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:31:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:31:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8416, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:40:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8410, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.123.117.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:41:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:41:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8407, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.116.230.204", "classifications": [], "first_seen": { "$date": "2023-03-06T07:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:43:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 367, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "126.113.24.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T07:45:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:05:11Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 11" ], "sightings": 4968, "tags": [ "tcp", "ssh", "alert", "libssh-0.6.3" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.238.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T07:53:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:29:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13899, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.179.7.204", "classifications": [], "first_seen": { "$date": "2023-03-06T07:48:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:48:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 730, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "50.186.144.62", "classifications": [], "first_seen": { "$date": "2023-03-06T07:58:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T07:58:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2184, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.128.232.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:01:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:01:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8400, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.114.44.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:07:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:07:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8399, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.74.239.20", "classifications": [], "first_seen": { "$date": "2023-03-06T08:12:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:30:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum" ], "sightings": 24302, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "5.75.144.65", "classifications": [], "first_seen": { "$date": "2023-03-06T08:15:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:06:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 7224, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.2.62.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:04:12Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 57", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7563, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "161.82.233.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:20:31Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 65", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30813, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "71.6.233.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:21:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:30:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8402, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.237.199.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:21:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:21:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20974, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "79.104.0.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:21:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:38:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53431, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.51.203.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:22:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:41:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37661, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.201.44.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:23:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:54:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 29444, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "165.154.51.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:26:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:37:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33489, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "74.82.47.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:29:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:29:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8388, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.227.28.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:29:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:29:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20954, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "77.21.0.58", "classifications": [], "first_seen": { "$date": "2023-03-06T08:18:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:18:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 420, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "81.12.42.2", "classifications": [], "first_seen": { "$date": "2023-03-06T08:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:09:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 7580, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.114", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-06T08:30:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:41:59Z" }, "ports": [ 80, 0, 1900, 161, 111 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 13087, "tags": [ "alert", "tcp", "http", "icmp", "udp", "snmp", "sunrpc", "portmapper" ], "rule_count": 9, "classification_count": 4 }, { "ioc": "107.170.228.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:34:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:20:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.45.83.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:36:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8370, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:38:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:34:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17043, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.195.130", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:34:16Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24916, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "51.103.69.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:47:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:47:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8358, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.220.173.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:47:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:03:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29203, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.174.217.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T08:50:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:35:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 126737, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.180.252", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:55:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:55:00Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16696, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.200.116.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:58:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:49:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18968, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.150.207.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T08:59:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T08:59:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8344, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.63.151.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T09:18:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:18:28Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12484, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "88.202.190.148", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-06T09:23:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:23:53Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12479, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "178.128.125.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T09:23:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:55:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 83", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21270, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.75.32.130", "classifications": [], "first_seen": { "$date": "2023-03-06T09:25:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:31:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA TCPv4 invalid checksum" ], "sightings": 40637, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "157.230.9.57", "classifications": [], "first_seen": { "$date": "2023-03-06T09:25:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:11:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55", "ET 3CORESec Poor Reputation IP group 15", "ET SCAN Potential SSH Scan" ], "sightings": 20184, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "216.13.26.79", "classifications": [], "first_seen": { "$date": "2023-03-06T09:26:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:21:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 129", "ET SCAN Potential SSH Scan" ], "sightings": 18376, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "139.59.70.64", "classifications": [], "first_seen": { "$date": "2023-03-06T09:26:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:26:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 39" ], "sightings": 357, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "138.68.226.175", "classifications": [], "first_seen": { "$date": "2023-03-06T09:28:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:10:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 36", "ET SCAN Potential SSH Scan" ], "sightings": 20537, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "107.170.242.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T09:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:40:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T09:44:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:44:41Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12458, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "125.228.88.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T09:48:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:48:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8302, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.112.78.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T09:52:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:09:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41398, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.202.190.19", "classifications": [], "first_seen": { "$date": "2023-03-06T09:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:44:06Z" }, "ports": [ 42164, 36758, 51675 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 9670, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.46", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-06T09:54:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:25:45Z" }, "ports": [ 0, 1900, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "(stream_tcp) data on SYN packet" ], "sightings": 46135, "tags": [ "icmp", "udp", "tcp", "http" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "93.157.174.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T09:55:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:14:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51180, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "81.69.36.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T09:57:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:57:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8301, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.187.177.143", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T09:58:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:58:11Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16585, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "24.217.122.52", "classifications": [], "first_seen": { "$date": "2023-03-06T09:50:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T09:50:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 354, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "51.254.101.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T10:02:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T08:48:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37637, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "81.89.110.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T10:05:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:19:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4606, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.205.194.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T10:05:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:48:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 123597, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.226.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T10:08:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:17:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14172, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T10:21:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T01:54:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8274, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.146.196.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T10:28:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:39:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16488, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.107.112.248", "classifications": [], "first_seen": { "$date": "2023-03-06T10:18:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 702, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "183.107.47.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T10:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:25:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 21", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2696, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "216.218.206.113", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-06T10:33:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:18:38Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17308, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "110.141.46.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T10:43:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:17:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 228286, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.175.50.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T10:44:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:55:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41145, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T10:41:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:23:07Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 354, "tags": [ "alert", "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "121.157.157.209", "classifications": [], "first_seen": { "$date": "2023-03-06T10:45:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:45:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 350, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "172.105.77.209", "classifications": [], "first_seen": { "$date": "2023-03-06T10:47:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:47:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1400, "tags": [ "alert", "tcp", "ssh", "anomaly" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "216.218.206.101", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-06T10:47:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:52:16Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31675, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.226.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T10:51:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:30:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14349, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.65.224.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T10:57:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:14:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36937, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.143.96.123", "classifications": [], "first_seen": { "$date": "2023-03-06T10:58:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T10:58:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 163" ], "sightings": 349, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T11:11:55Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:33:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8691, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.2.220.182", "classifications": [], "first_seen": { "$date": "2023-03-06T11:10:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:10:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 348, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "126.114.216.247", "classifications": [], "first_seen": { "$date": "2023-03-06T11:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:14:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 348, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.99.8.63", "classifications": [], "first_seen": { "$date": "2023-03-06T11:16:25Z" }, "ja3": [ "19e29534fd49dd27d09234e639c4057e" ], "last_seen": { "$date": "2023-03-06T11:16:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "REQUEST_BODY_UNEXPECTED", "SURICATA HTTP Unexpected Request body" ], "sightings": 2088, "tags": [ "alert", "tcp", "ssh", "anomaly", "tls", "http" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "194.247.199.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T11:17:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:17:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8194, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.130.54.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T11:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:25:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8182, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.59.4.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T11:19:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:37:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 63", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1812, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "35.223.246.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T11:20:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:41:02Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 96329, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.177.228", "classifications": [], "first_seen": { "$date": "2023-03-06T11:20:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:09:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 4489, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.135.130.122", "classifications": [], "first_seen": { "$date": "2023-03-06T11:20:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:10:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 147", "ET SCAN Potential SSH Scan" ], "sightings": 17250, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "118.46.46.193", "classifications": [], "first_seen": { "$date": "2023-03-06T11:29:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:29:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 346, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.199.121.22", "classifications": [], "first_seen": { "$date": "2023-03-06T11:32:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:32:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid request line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) invalid status line" ], "sightings": 16348, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "183.103.201.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T11:36:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:54:07Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14054, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "15.181.49.42", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T11:42:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:42:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20417, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "177.135.206.73", "classifications": [], "first_seen": { "$date": "2023-03-06T11:48:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:48:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 344, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "20.227.166.16", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T11:46:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:46:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20402, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "3.67.84.46", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T11:48:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T11:48:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20402, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.3.128.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T11:58:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:29:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 140156, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.131.181.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T12:02:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:21:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15020, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.192.211.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T12:05:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:21:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32512, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.145.81.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T12:11:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:21:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24375, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.230.6", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T12:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:11:11Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16287, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.77.223.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T12:13:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:44:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47280, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.211.12", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T12:13:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:44:23Z" }, "ports": [ 161, 0, 5060 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 16267, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "190.56.154.33", "classifications": [], "first_seen": { "$date": "2023-03-06T12:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:06:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 342, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "188.166.217.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T12:18:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:31:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32420, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.195.221.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T12:20:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:04:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.153.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T12:21:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:09:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15654, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.198.255.174", "classifications": [], "first_seen": { "$date": "2023-03-06T12:23:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:23:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 8108, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "195.242.232.242", "classifications": [], "first_seen": { "$date": "2023-03-06T12:25:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:25:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 341, "tags": [ "ssh", "tcp", "ssh", "PuTTY_Release_0.77", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "174.138.60.37", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T12:36:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:36:30Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16180, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "207.44.17.23", "classifications": [], "first_seen": { "$date": "2023-03-06T12:38:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T12:38:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 340, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.189.13.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T12:49:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:12:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 45845, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "148.153.204.50", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T12:52:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:38:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 42567, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "103.103.30.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T12:56:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:36:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120385, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.126.119.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T12:56:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:02:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 28" ], "sightings": 36294, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.212.64.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:55:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41741, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "105.155.253.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:02:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:09:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39942, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "105.159.251.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:08:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:42:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20066, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.16.94.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:08:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:21:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32156, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.128.66.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:08:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:21:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32159, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.158.156.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:10:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:27:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22123, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "105.155.253.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:14:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:58:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28032, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.116.138.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:31:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36117, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.161.27.163", "classifications": [], "first_seen": { "$date": "2023-03-06T13:16:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:22:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 41" ], "sightings": 12423, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "146.190.63.172", "classifications": [], "first_seen": { "$date": "2023-03-06T13:16:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:07:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 7060, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "105.159.251.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:23:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:12:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23962, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "169.150.201.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:24:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:24:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4015, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.171.84.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T13:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:21:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4722, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "116.211.120.51", "classifications": [], "first_seen": { "$date": "2023-03-06T13:21:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:21:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 337, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "178.223.153.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T13:30:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:30:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8025, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T13:33:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:33:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8020, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.232.24", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T13:39:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:33:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 93508, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "3.208.88.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T13:39:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:48:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 159474, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.219.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T13:41:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:41:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7995, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.103.146.180", "classifications": [], "first_seen": { "$date": "2023-03-06T13:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:42:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 22" ], "sightings": 732, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.33.108.114", "classifications": [], "first_seen": { "$date": "2023-03-06T13:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:42:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 336, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "123.193.154.30", "classifications": [], "first_seen": { "$date": "2023-03-06T13:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:43:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 336, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "5.200.70.148", "classifications": [], "first_seen": { "$date": "2023-03-06T13:52:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:44:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 166", "ET SCAN Potential SSH Scan" ], "sightings": 16679, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "65.109.165.112", "classifications": [], "first_seen": { "$date": "2023-03-06T13:54:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:42:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6675, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.204.50", "classifications": [], "first_seen": { "$date": "2023-03-06T13:54:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:52:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "ET SCAN Potential SSH Scan" ], "sightings": 13335, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "20.24.38.76", "classifications": [], "first_seen": { "$date": "2023-03-06T13:55:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T13:55:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 118" ], "sightings": 335, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "207.148.72.112", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T14:02:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:06:53Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 125659, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "87.236.176.5", "classifications": [], "first_seen": { "$date": "2023-03-06T14:05:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:25:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 6579, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "203.251.108.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:05:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:07:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7949, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.83.65.199", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T14:07:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:07:25Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15893, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "87.236.176.10", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T14:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:09:26Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15886, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "138.59.219.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T14:16:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:16:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7931, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.135.159.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:37:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:45:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 118552, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.23.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:57:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 38", "ET SCAN Potential SSH Scan" ], "sightings": 44300, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "211.194.83.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:39:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:56:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 46131, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.210.52.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:40:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:28:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 117739, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.62.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:57:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66650, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.215.100.37", "classifications": [], "first_seen": { "$date": "2023-03-06T14:39:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:40:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 95", "ET 3CORESec Poor Reputation IP group 22", "ET SCAN Potential SSH Scan" ], "sightings": 13488, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "192.241.169.184", "classifications": [], "first_seen": { "$date": "2023-03-06T14:40:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:30:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105", "ET SCAN Potential SSH Scan" ], "sightings": 16459, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "182.75.216.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:42:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:27:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 90", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20086, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "150.230.46.216", "classifications": [], "first_seen": { "$date": "2023-03-06T14:42:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:57:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1982, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "108.175.3.195", "classifications": [], "first_seen": { "$date": "2023-03-06T14:43:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:18:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3960, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "203.172.76.4", "classifications": [], "first_seen": { "$date": "2023-03-06T14:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:44:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120" ], "sightings": 331, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "151.74.30.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:51:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:51:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7887, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.203.213.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T14:55:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T14:56:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7870, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.57.36.181", "classifications": [], "first_seen": { "$date": "2023-03-06T14:58:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:29:26Z" }, "ports": [ 65070, 24518, 64256, 16523, 54413 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 10812, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.160.71", "classifications": [], "first_seen": { "$date": "2023-03-06T15:01:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:03:47Z" }, "ports": [ 5443, 9443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 7859, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "217.10.40.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:04:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:20:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35266, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.7.64.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:04:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:04:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3928, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.225.73.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T15:04:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:04:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7855, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.149.49.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:05:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:21:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39179, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.58.216.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:05:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:31:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43484, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.161.96.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:06:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:19:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31352, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.27.37.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:07:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:24:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11755, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.160.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:08:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:21:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43083, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "116.110.234.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:11:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:11:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7843, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.166.228.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:16:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:31:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35172, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.25.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:16:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:35:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 38", "ET SCAN Potential SSH Scan" ], "sightings": 48223, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "165.22.220.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:19:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:33:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35135, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.90.162.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T15:27:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:41:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9005, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.2.56.154", "classifications": [], "first_seen": { "$date": "2023-03-06T15:27:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:27:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 57", "ET 3CORESec Poor Reputation IP group 40" ], "sightings": 654, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "179.43.98.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:30:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:14:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8177, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "168.232.165.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:31:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:46:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31105, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.80.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:31:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:46:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31102, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.131.12.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:33:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:43:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34994, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.162.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T15:34:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:45:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31095, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.95.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T15:38:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:38:48Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11660, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.110.112", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T15:40:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:40:47Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11654, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "172.105.233.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T15:41:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:07:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15205, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.229.155.61", "classifications": [], "first_seen": { "$date": "2023-03-06T15:46:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T15:46:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 326, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T16:10:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:10:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7750, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.116.6.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T16:12:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:12:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.216.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T16:18:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:33:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34795, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.95.124.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T16:20:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:21:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7741, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.201.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T16:38:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:07:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7729, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.54.169.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T16:39:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:54:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11497, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.183.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T16:45:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:59:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15017, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.176.90.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T16:54:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:55:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10007, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.116.127.155", "classifications": [], "first_seen": { "$date": "2023-03-06T16:58:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T16:58:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 330, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "98.98.170.187", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:00:59Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:00:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 42680, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "18.208.132.29", "classifications": [], "first_seen": { "$date": "2023-03-06T17:08:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:08:02Z" }, "ports": [ 5060 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 3843, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "196.46.191.30", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T17:09:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:50:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 35060, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "198.199.102.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:07:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:54:07Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5938, "tags": [ "alert", "tcp", "ssh", "anomaly", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "45.43.33.210", "classifications": [], "first_seen": { "$date": "2023-03-06T17:07:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:07:59Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 34" ], "sightings": 320, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "78.113.142.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:15:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:15:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7679, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.247.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:20:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:20:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7679, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.174.51.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:31:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:33:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 53648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.37.245.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:37:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:37:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15330, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.222.174.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:37:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T03:19:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44504, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.204.254.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:38:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:19:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 89506, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.127.59.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T17:43:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:43:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.102.85.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T17:53:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T17:55:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7634, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.67.184.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T17:56:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:09:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19073, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.199.122.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T17:59:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:11:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30505, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.156.231.91", "classifications": [], "first_seen": { "$date": "2023-03-06T18:08:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:08:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 3812, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.154.194.20", "classifications": [], "first_seen": { "$date": "2023-03-06T18:10:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:27:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 31583, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "103.151.36.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T18:25:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:02:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9970, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.190.92", "classifications": [], "first_seen": { "$date": "2023-03-06T18:32:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:32:19Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 3804, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "90.3.176.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T18:33:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:33:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7605, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.169.12.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T18:39:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:50:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22796, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.226.13", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T18:42:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:33:04Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 7604, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.11.47.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T18:51:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T08:15:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14340, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.233.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T18:53:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:36:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58171, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "3.110.35.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T18:54:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:46:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 113466, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.247.109.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T18:56:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:07:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26554, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.157.25.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T18:57:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:08:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26551, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.214.22", "classifications": [], "first_seen": { "$date": "2023-03-06T18:55:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T18:55:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 626, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "74.82.47.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T19:01:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:49:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7597, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.111.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T19:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:22:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12688, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.75", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T19:22:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:23:41Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 5654, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.235.170.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T19:24:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:15:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6455, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.6.225.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T19:26:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:42:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30228, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.218.78.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T19:27:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:10:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10886, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.19.14.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T19:33:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:33:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7562, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.93.240.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T19:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:38:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3802, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.3", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-06T19:35:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:40:21Z" }, "ports": [ 80, 0, 5632, 53 ], "reporting_nodes": 3, "rules": [ "ET 3CORESec Poor Reputation IP group 25", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response", "PROTOCOL-DNS named version attempt" ], "sightings": 33488, "tags": [ "alert", "tcp", "http", "icmp", "udp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "212.113.106.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T19:54:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:00:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40288, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "2.57.122.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T19:54:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:05:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34121, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.57.121.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T19:56:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T19:56:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.91.91.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T20:06:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:28:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45154, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "13.126.114.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T20:12:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:21:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 112164, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.123.160.123", "classifications": [], "first_seen": { "$date": "2023-03-06T20:16:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:19:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3387, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "149.202.86.3", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-06T20:22:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:22:25Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 45119, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.34.192.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T20:27:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:50:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9469, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.141.157.219", "classifications": [], "first_seen": { "$date": "2023-03-06T20:22:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:18:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 7027, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.110.234.191", "classifications": [], "first_seen": { "$date": "2023-03-06T20:22:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:22:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 44" ], "sightings": 307, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "223.197.151.55", "classifications": [], "first_seen": { "$date": "2023-03-06T20:24:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:14:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6725, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.194.181.153", "classifications": [], "first_seen": { "$date": "2023-03-06T20:25:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:16:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8567, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "86.123.209.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T20:30:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:30:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7516, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.106.38.158", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-03-06T20:36:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:16:54Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 23237, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "151.106.39.6", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-03-06T20:38:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:06:12Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 251294, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.131.47.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T20:43:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:06:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37537, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.68.226.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T20:48:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:09:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32045, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.168.114.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T20:59:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:59:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7503, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.19.164.166", "classifications": [], "first_seen": { "$date": "2023-03-06T20:55:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T20:55:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 305, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "115.87.34.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T21:01:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:01:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7499, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.82.24.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T21:17:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:37:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11014, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.211.46.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T21:25:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:43:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26146, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.129.102.37", "classifications": [], "first_seen": { "$date": "2023-03-06T21:30:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:03:41Z" }, "ports": [ 21 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 72014, "tags": [ "tcp", "ftp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.235.24.38", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T21:32:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:42:54Z" }, "ports": [ 53, 0, 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 11423, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "36.103.235.133", "classifications": [], "first_seen": { "$date": "2023-03-06T21:41:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:12:00Z" }, "ports": [ 33387, 4786, 53921, 14265, 3357, 51049, 8099, 50536, 1962, 3567, 2404, 1800, 14610, 8000, 55457, 51420, 50686, 14444, 13333, 51944, 6688, 6001, 2086, 51471, 54804, 9042, 13579, 8008, 5938, 2082, 1400 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 55175, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.37.83.158", "classifications": [], "first_seen": { "$date": "2023-03-06T21:36:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:36:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 302, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "41.175.18.170", "classifications": [], "first_seen": { "$date": "2023-03-06T21:37:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:42:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 143" ], "sightings": 11070, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "161.97.104.148", "classifications": [], "first_seen": { "$date": "2023-03-06T21:38:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:31:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6289, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.10.160.120", "classifications": [], "first_seen": { "$date": "2023-03-06T21:40:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:23:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8988, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "23.94.217.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T21:52:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:07:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37201, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.182.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T21:52:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:27:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47032, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.8.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T21:55:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:43:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58344, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "63.135.161.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T21:56:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:56:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7450, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.164.216.64", "classifications": [], "first_seen": { "$date": "2023-03-06T21:55:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T21:56:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 900, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "89.248.163.215", "classifications": [], "first_seen": { "$date": "2023-03-06T22:16:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:16:20Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 299, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.22.223.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T22:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T13:10:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7431, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.97.145.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T22:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:47:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8750, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.94.93.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T22:17:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:08:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.100.155.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:26:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:38:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29614, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.1.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:28:08Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:05:29Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12", "ET SCAN Potential SSH Scan" ], "sightings": 125853, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.5.10.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:28:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:37:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22210, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.37.227.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:30:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:39:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29604, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.134.144.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T22:38:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:22:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 427043, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.107.37.6", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-06T22:39:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:39:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 18493, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.74.46.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:34:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:15:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34", "ET 3CORESec Poor Reputation IP group 11", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17045, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "181.94.247.2", "classifications": [], "first_seen": { "$date": "2023-03-06T22:36:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:43:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 89" ], "sightings": 10879, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.68.149.134", "classifications": [], "first_seen": { "$date": "2023-03-06T22:37:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:24:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 138", "ET 3CORESec Poor Reputation IP group 33", "ET SCAN Potential SSH Scan" ], "sightings": 15039, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "104.131.13.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:37:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:14:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 10", "ET 3CORESec Poor Reputation IP group 2", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22786, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "103.177.178.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:51:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T22:51:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7386, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "132.248.65.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:51:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:54:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48728, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.203.172.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T22:58:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:39:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 325, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.18.73.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T23:06:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:56:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 869727, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.85.167.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:08:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:09:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7366, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.231.33.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:06:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2083, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.170.109.90", "classifications": [], "first_seen": { "$date": "2023-03-06T23:05:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:05:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 181" ], "sightings": 294, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "217.182.75.250", "classifications": [], "first_seen": { "$date": "2023-03-06T23:07:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:50:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 130" ], "sightings": 380, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "137.184.30.179", "classifications": [], "first_seen": { "$date": "2023-03-06T23:08:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:53:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 5551, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "210.245.36.43", "classifications": [], "first_seen": { "$date": "2023-03-06T23:08:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:46:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2040, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "5.253.244.167", "classifications": [], "first_seen": { "$date": "2023-03-06T23:10:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:10:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 168" ], "sightings": 294, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.236.176.91", "classifications": [], "first_seen": { "$date": "2023-03-06T23:12:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:16:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 882, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "113.161.64.22", "classifications": [], "first_seen": { "$date": "2023-03-06T23:13:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:00:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6693, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "152.67.197.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:16:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:29:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11028, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.32.162.176", "classifications": [ "Misc activity", "Detection of a Network Scan", "Potentially Bad Traffic", "Attempted Information Leak", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-03-06T23:24:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-20T13:58:25Z" }, "ports": [ 0, 1900, 69, 161, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "(icmp4) ICMP ping Nmap", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS DNS query amplification attempt", "(stream_tcp) data on SYN packet" ], "sightings": 1248931, "tags": [ "icmp", "udp", "tftp", "snmp", "tcp" ], "rule_count": 12, "classification_count": 5 }, { "ioc": "172.105.228.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T23:24:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:22:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14513, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.6.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:25:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:41:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44019, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.196.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:25:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:40:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33017, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.126.128.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:27:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:27:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7347, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.99.102.232", "classifications": [], "first_seen": { "$date": "2023-03-06T23:19:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:17:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 5257, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.156.39.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:21:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:51:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 27513, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "128.199.193.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:22:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:19:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 26", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10767, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "113.160.248.80", "classifications": [], "first_seen": { "$date": "2023-03-06T23:23:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:18:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8667, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "36.134.23.23", "classifications": [], "first_seen": { "$date": "2023-03-06T23:28:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:44:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 69422, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.5", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "170.187.164.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T23:39:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:05:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.33.129.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T23:44:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:44:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7333, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.133.57.242", "classifications": [], "first_seen": { "$date": "2023-03-06T23:34:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:40:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 2" ], "sightings": 10915, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "161.35.217.94", "classifications": [], "first_seen": { "$date": "2023-03-06T23:35:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:35:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 64", "ET 3CORESec Poor Reputation IP group 16" ], "sightings": 580, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "175.207.13.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:38:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:30:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 81", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 544, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.104.78.164", "classifications": [], "first_seen": { "$date": "2023-03-06T23:39:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:43:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 580, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "207.180.205.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-06T23:45:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:45:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10301, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.43.155.135", "classifications": [], "first_seen": { "$date": "2023-03-06T23:46:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:35:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 86", "ET SCAN Potential SSH Scan" ], "sightings": 14624, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "183.230.230.215", "classifications": [], "first_seen": { "$date": "2023-03-06T23:46:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:09:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 9222, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.27.32", "classifications": [], "first_seen": { "$date": "2023-03-06T23:47:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:59:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62" ], "sightings": 4624, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "136.175.200.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-06T23:45:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:36:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.171.166", "classifications": [], "first_seen": { "$date": "2023-03-06T23:49:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:02:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2599, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.230.178.127", "classifications": [], "first_seen": { "$date": "2023-03-06T23:49:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:59:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 54" ], "sightings": 5201, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.102.206", "classifications": [], "first_seen": { "$date": "2023-03-06T23:50:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:59:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1734, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "178.128.117.5", "classifications": [], "first_seen": { "$date": "2023-03-06T23:51:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-06T23:51:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 83" ], "sightings": 309, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.248.165.30", "classifications": [], "first_seen": { "$date": "2023-03-07T00:03:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:04:25Z" }, "ports": [ 2242, 2095 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 7317, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.124.205.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:04:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:04:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3659, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "151.69.90.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:04:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:10:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 109357, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.78.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:04:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:23:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39927, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.101.135.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:05:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:21:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39932, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.110.148.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:05:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:32:50Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 43" ], "sightings": 59759, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.110.85.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:05:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:12:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10939, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.185.78.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:05:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:49:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9971, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.195.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:05:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:21:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36280, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.127.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:05:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:21:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39937, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "132.148.75.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:05:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:43:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37978, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.168.64.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:05:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:10:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7301, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.194.60.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:06:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:56:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47403, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.121.106.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:14:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 97" ], "sightings": 32732, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.94.106.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:06:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:07:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25096, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.182.216.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:06:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:50:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 108273, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.104.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:06:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:19:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29056, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.75.250.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:07:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:46:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 108307, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.157.28.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:07:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:20:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 36339, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.189.124.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:07:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:14:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 109" ], "sightings": 14698, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.99.123.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:07:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:07:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3651, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.134.11.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:07:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:19:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32679, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.245.94.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:07:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:19:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18161, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.205.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:08:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:20:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61" ], "sightings": 36481, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.182.253.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:08:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:19:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32683, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.209.237.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:08:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:21:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39904, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.145.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:08:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:19:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32681, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "80.253.246.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:08:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:25:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46378, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.245.237.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:09:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:27:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32606, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "84.201.173.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:25:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41406, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.8.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:09:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:20:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 85", "ET SCAN Potential SSH Scan" ], "sightings": 36906, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.146.202.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:10:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:22:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28979, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.248.133.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:13:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:07:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8134, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.80.243", "classifications": [], "first_seen": { "$date": "2023-03-07T00:18:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:18:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 642, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.180.110.211", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:15:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:15:56Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14487, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.83.33.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:19:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:19:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7237, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.228.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:25:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:17:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.6.89.224", "classifications": [], "first_seen": { "$date": "2023-03-07T00:21:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:25:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 852, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.48.175.222", "classifications": [], "first_seen": { "$date": "2023-03-07T00:33:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:45:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1413, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.252.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:30:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:04:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7703, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.99.161.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:32:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T11:26:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12583, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.136.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:32:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:32:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7213, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "150.249.174.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:38:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:38:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 43166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.215.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:38:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:45:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14141, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.255.234.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:41:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T00:41:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7193, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.204.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T00:57:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T20:18:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14673, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.70.64.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T00:59:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:13:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35889, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.139.193.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T01:00:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:13:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28714, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.239.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:09:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:17:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44928, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.100.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:10:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:04:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9081, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.179.160.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:12:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:12:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7174, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.191.9.204", "classifications": [], "first_seen": { "$date": "2023-03-07T01:17:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:17:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 281, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.200.90.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T01:15:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T05:24:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8469, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.182.32.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:33:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:33:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7160, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.45", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:39:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:06:51Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72731, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "46.3.223.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:42:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:28:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21129, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.112.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:44:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:43:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.210.149.157", "classifications": [], "first_seen": { "$date": "2023-03-07T01:45:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:45:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 163", "ET 3CORESec Poor Reputation IP group 38" ], "sightings": 554, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "98.147.157.94", "classifications": [], "first_seen": { "$date": "2023-03-07T01:52:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:52:16Z" }, "ports": [ 37215 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 7139, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "184.105.139.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:52:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:12:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14127, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:58:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:58:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7134, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T01:59:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T01:59:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.213.131.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T01:59:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:15:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35633, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.149.17.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T02:02:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:02:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7133, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T02:04:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:00:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T02:06:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:32:01Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet", "(stream_tcp) reset outside window" ], "sightings": 24684, "tags": [ "icmp", "tcp", "http" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "44.200.22.103", "classifications": [], "first_seen": { "$date": "2023-03-07T02:07:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:07:08Z" }, "ports": [ 8443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 3564, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.236.2.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:07:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:23:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39179, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.244.77.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:10:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T11:07:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32108, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.39.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:12:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:57:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48793, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.64", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T02:07:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:55:41Z" }, "ports": [ 80, 177, 0 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10906, "tags": [ "alert", "tcp", "http", "udp", "xdmcp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "72.14.181.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T02:21:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:34:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14085, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.247.129.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T02:26:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:26:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7121, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.162.32.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:30:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:45:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28372, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.83.43.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:32:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:45:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35466, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.194.206.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:33:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T03:17:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 105876, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.69.134.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:33:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:46:10Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 106171, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.19.102.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:34:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:45:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25865, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.5.241", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-03-07T02:37:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:41:12Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 94811, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "119.23.108.22", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T02:40:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T20:53:14Z" }, "ports": [ 1900, 0, 161 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 322154, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "137.184.2.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:36:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:37:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 33", "ET 3CORESec Poor Reputation IP group 12", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17574, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "8.213.129.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:46:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8620, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.103.45.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:38:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T01:28:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25936, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.157.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:40:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:01:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 68", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9361, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.95.144", "classifications": [], "first_seen": { "$date": "2023-03-07T02:41:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T03:31:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 5706, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "160.155.113.19", "classifications": [], "first_seen": { "$date": "2023-03-07T02:42:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T02:42:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 63" ], "sightings": 273, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.140.207.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T02:54:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:23:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 399, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.139.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T03:10:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:56:39Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 14075, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "159.223.194.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T03:10:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:18:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9613, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.129.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T03:10:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:59:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18521, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.59.250.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T03:14:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T03:27:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31631, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.65.145.99", "classifications": [], "first_seen": { "$date": "2023-03-07T03:12:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T03:12:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 542, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "184.105.139.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T03:25:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:04:04Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 38069, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "172.105.218.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T03:29:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:44:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13403, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.49.236.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T03:31:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T03:31:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7027, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.152", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-07T03:38:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:07:13Z" }, "ports": [ 53, 0, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 17132, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "139.198.187.234", "classifications": [], "first_seen": { "$date": "2023-03-07T03:34:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:01:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA TCPv4 invalid checksum" ], "sightings": 25489, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "64.62.197.36", "classifications": [ "Decode of an RPC Query", "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-07T03:49:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:56:15Z" }, "ports": [ 111, 0, 69, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get", "SQL ping attempt" ], "sightings": 43277, "tags": [ "udp", "sunrpc", "portmapper", "icmp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "139.144.19.178", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-07T03:50:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:38:20Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20554, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T03:50:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:29:11Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 5991, "tags": [ "tcp", "http", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "205.210.31.166", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:01:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:35:09Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17349, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.151.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:03:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:55:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8288, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.67.212.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:05:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:12:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90437, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "197.140.18.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:05:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:21:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27995, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.199.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:06:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:16:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8050, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.64.178.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:06:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:21:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31487, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.99.84.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:08:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:25:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20976, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.98.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:14:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7003, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.227", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:15:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:51:21Z" }, "ports": [ 161, 0, 177 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 43184, "tags": [ "udp", "snmp", "icmp", "xdmcp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "43.157.10.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:17:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:30:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 153", "ET SCAN Potential SSH Scan" ], "sightings": 31488, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "81.92.194.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:17:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:59:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 93810, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.72.126.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:18:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:01:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22431, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.206.175.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:18:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:34:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20921, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.21.208.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:20:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:55:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23379, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "50.93.152.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:22:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:37:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20903, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.67.154.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:22:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:37:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 20899, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.173.209.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:22:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:32:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20925, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.22.218.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:22:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:35:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20911, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.174.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:26:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:37:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34809, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.195.117.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:26:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:37:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27850, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.68.251.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:30:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:30:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6966, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.53.145.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:36:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T04:36:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream after TCP reset sent" ], "sightings": 10435, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "172.105.9.29", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:48:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:04:39Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20734, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.139.94", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-07T04:49:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:50:13Z" }, "ports": [ 177, 0, 1900, 111 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 13144, "tags": [ "udp", "xdmcp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 4 }, { "ioc": "144.24.152.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:49:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:06:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31179, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.130.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:50:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:05:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 59" ], "sightings": 38124, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.133.36.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T04:53:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:53:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 121133, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "219.147.85.160", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T04:57:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:06:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 33923, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.170.163.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T05:12:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:12:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6920, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.192.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T05:13:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:08:46Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19793, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "109.121.224.181", "classifications": [], "first_seen": { "$date": "2023-03-07T05:13:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:13:52Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 3459, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.163.125.183", "classifications": [], "first_seen": { "$date": "2023-03-07T05:11:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:11:06Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 263, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.211.97.235", "classifications": [], "first_seen": { "$date": "2023-03-07T05:11:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:59:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 110", "ET SCAN Potential SSH Scan" ], "sightings": 13076, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "54.158.205.161", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T05:21:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:21:34Z" }, "ports": [ 23, 2079, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 13810, "tags": [ "tcp", "telnet", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "34.92.83.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T05:21:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:32:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27610, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.105.217.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T05:25:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:26:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13703, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.207.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T05:26:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:30:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23701, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.82", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T05:28:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:46:56Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18122, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "104.128.95.117", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-03-07T05:34:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:34:50Z" }, "ports": [ 0, 23, 7001 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-ICMP PING Unix", "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP Echo Reply", "(port_scan) TCP portscan", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "POLICY-OTHER AFS access" ], "sightings": 44788, "tags": [ "icmp", "tcp", "telnet", "udp" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "50.254.136.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T05:37:57Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:28:43Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 162", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34003, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "164.92.212.181", "classifications": [], "first_seen": { "$date": "2023-03-07T05:39:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:28:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 68", "ET SCAN Potential SSH Scan" ], "sightings": 12718, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "188.27.145.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T05:45:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:45:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6885, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T05:46:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:20:24Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 13748, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "122.195.199.249", "classifications": [], "first_seen": { "$date": "2023-03-07T05:46:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:46:34Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 6885, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.27.91.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T05:49:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T05:49:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6883, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.43", "classifications": [ "Misc activity", "Detection of a Network Scan", "Information Leak" ], "first_seen": { "$date": "2023-03-07T06:00:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:55:51Z" }, "ports": [ 0, 1900, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "SQL ping attempt", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37970, "tags": [ "icmp", "udp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "178.62.117.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:02:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:38:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34392, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.128.232.126", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-07T06:04:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:34:00Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35906, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.18.214.5", "classifications": [], "first_seen": { "$date": "2023-03-07T06:11:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:32:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1804, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.80.40.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:11:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:48:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1096, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.75.38.14", "classifications": [], "first_seen": { "$date": "2023-03-07T06:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:26:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1806, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "179.60.150.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:16:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:38:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 87", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 291, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.73.131.24", "classifications": [], "first_seen": { "$date": "2023-03-07T06:17:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:31:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1029, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "143.198.85.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:17:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:07:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8190, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.224.2.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:18:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:14:44Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1084, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "5.157.115.52", "classifications": [], "first_seen": { "$date": "2023-03-07T06:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:18:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 165", "ET SCAN Potential SSH Scan" ], "sightings": 2914, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "91.213.50.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:19:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:02:01Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42239, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.244.142.80", "classifications": [], "first_seen": { "$date": "2023-03-07T06:20:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:13:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 32309, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "152.89.47.138", "classifications": [], "first_seen": { "$date": "2023-03-07T06:22:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T06:39:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1537, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "68.183.81.203", "classifications": [], "first_seen": { "$date": "2023-03-07T06:41:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:35:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 47242, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "139.198.0.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:51:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:25:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 102136, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.29.27.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:52:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:07:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 35172, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.194.167.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T06:55:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:09:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17086, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "199.188.203.65", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T06:59:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:38:41Z" }, "ports": [ 0, 1900, 161, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 475886, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "187.34.31.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T07:09:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:40:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 202856, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.161.48.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T07:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:16:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6810, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.64.174.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T07:17:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:31:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25762, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.184.151.98", "classifications": [], "first_seen": { "$date": "2023-03-07T07:20:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T08:07:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6260, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.168.27.14", "classifications": [], "first_seen": { "$date": "2023-03-07T07:23:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:23:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 252, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "113.6.251.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T07:31:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:31:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16979, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "173.76.23.95", "classifications": [], "first_seen": { "$date": "2023-03-07T07:36:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T07:36:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 502, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.122.177.117", "classifications": [], "first_seen": { "$date": "2023-03-07T08:05:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T08:09:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 23066, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "195.181.41.188", "classifications": [], "first_seen": { "$date": "2023-03-07T08:07:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T08:11:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 495, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "143.42.115.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T08:19:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:24:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12887, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.115.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T08:24:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:54:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13418, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.195.114.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T08:32:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T08:33:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6735, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.122.38.52", "classifications": [], "first_seen": { "$date": "2023-03-07T08:35:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T08:35:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 245, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "64.62.197.191", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T09:00:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:55:49Z" }, "ports": [ 0, 1434, 80 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 15105, "tags": [ "icmp", "udp", "alert", "tcp", "http" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "113.193.0.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T09:08:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:08:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 6706, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.233.216", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T09:12:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:12:13Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23468, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "115.219.144.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T09:13:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:13:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.70.180.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T09:24:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:24:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6701, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.219.129.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T09:25:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:43:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13431, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.225.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T09:42:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T09:42:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6685, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.122.40.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T10:04:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:20:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43247, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.19.187.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T10:07:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:20:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 30204, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.89.10.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T10:09:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:09:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6673, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.1.227.40", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T10:09:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:28:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 25684, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "51.178.27.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T10:09:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:40:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39916, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T10:13:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:41:11Z" }, "ports": [ 80, 0 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20429, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "223.197.125.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T10:14:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:27:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16606, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.132.182.23", "classifications": [], "first_seen": { "$date": "2023-03-07T10:28:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:28:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 237, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "192.241.221.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T10:30:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:57:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.208.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T10:32:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:04:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25631, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.235.22", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T10:39:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T06:33:33Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12475, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "120.28.137.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T10:42:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:42:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6629, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.188.47.9", "classifications": [], "first_seen": { "$date": "2023-03-07T10:37:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:19:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 7282, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.195.139.66", "classifications": [], "first_seen": { "$date": "2023-03-07T10:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:42:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6535, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.202.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T10:48:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:48:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6628, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.89.219.59", "classifications": [], "first_seen": { "$date": "2023-03-07T10:54:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T10:55:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1175, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "138.246.253.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T11:05:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:28:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28394, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.208.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T11:12:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:16:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16582, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.182.228.52", "classifications": [], "first_seen": { "$date": "2023-03-07T11:17:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:17:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 50", "ET 3CORESec Poor Reputation IP group 14", "ET SCAN Potential SSH Scan" ], "sightings": 570, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "181.214.167.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T11:28:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:28:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13203, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.117.152", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T11:28:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:30:08Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 21397, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "62.196.79.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T11:32:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:34:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6592, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.239.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T11:40:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T11:40:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6594, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.93.247.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T11:47:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:02:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12994, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.117.11.90", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T12:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:06:32Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 101908, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.189.1.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T12:08:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:59:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13061, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.197.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T12:13:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:56:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8786, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.167.15.178", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-07T12:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T12:14:51Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9862, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "223.17.143.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T12:21:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T12:22:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13141, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.224.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T12:28:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:17:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6594, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.58.109.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T12:28:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:05:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 10", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2569, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "118.122.148.156", "classifications": [], "first_seen": { "$date": "2023-03-07T12:28:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T12:47:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 24833, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "162.243.129.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T12:38:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:20:11Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 17449, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.104.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T12:38:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:17:22Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 9753, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "119.199.26.40", "classifications": [], "first_seen": { "$date": "2023-03-07T12:43:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T12:43:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 227, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.210.152.106", "classifications": [], "first_seen": { "$date": "2023-03-07T12:48:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:43:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 126", "ET SCAN Potential SSH Scan" ], "sightings": 12123, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.31.38.132", "classifications": [], "first_seen": { "$date": "2023-03-07T12:48:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:51:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 8" ], "sightings": 8532, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "206.189.38.110", "classifications": [], "first_seen": { "$date": "2023-03-07T12:48:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T12:48:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 122" ], "sightings": 227, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.249.87.203", "classifications": [], "first_seen": { "$date": "2023-03-07T12:48:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:55:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 115" ], "sightings": 8298, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.225.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T12:50:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:15:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11778, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.199.52", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T12:59:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:44:48Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 8163, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "138.197.180.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:00:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:17:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35", "ET 3CORESec Poor Reputation IP group 12" ], "sightings": 35966, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.144.254.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T13:03:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:46:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12728, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.119.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T13:10:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:10:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6542, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.225.56.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:19:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3266, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.142.53.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:19:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:19:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3265, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.131.30.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:19:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:31:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29348, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.92.207.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:28:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:43:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29299, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "94.180.247.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:29:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:16:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29356, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.139.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:30:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:45:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16277, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.202.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T13:34:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:34:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6520, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.206.165.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:38:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:23:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 97067, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.81.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:39:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:21:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 212728, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.83.66.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T13:43:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:43:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6503, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.83.67.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T13:45:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:45:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6498, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T13:48:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:16:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12372, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.53.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T13:51:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:37:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42223, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.141.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T13:54:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T13:54:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6488, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.130.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T13:56:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:55:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18454, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.188.206.106", "classifications": [], "first_seen": { "$date": "2023-03-07T14:01:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:53:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 96", "ET SCAN Potential SSH Scan" ], "sightings": 11396, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.193.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T14:02:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:02:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6474, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.199.18.204", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T14:05:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:16:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 20427, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "119.94.99.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T14:05:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:05:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6467, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.96.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T14:12:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:12:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6466, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.92.142.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T14:18:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:21:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.150.61.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T14:20:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:42:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19331, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.205.40.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T14:34:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:50:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38554, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.91.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T14:37:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:49:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28922, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.217.186.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T14:42:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T14:42:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38548, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.48.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T14:49:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:05:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32034, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "169.48.124.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T14:51:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:56:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19027, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.54.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T14:52:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:41:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30438, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.96.186.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T14:54:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:20:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25625, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.40.74.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T15:17:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:17:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6399, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.228.82.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T15:26:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:26:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6400, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.135.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:33:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:03:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7476, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.254.240.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:30:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:52:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51153, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.137.196.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:31:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:46:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31904, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.40.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:31:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:43:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "ET SCAN Potential SSH Scan" ], "sightings": 29522, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.134.235.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:31:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:46:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28714, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.97.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T15:32:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:39:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7467, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.238.67.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:33:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:48:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22331, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "197.227.8.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:39:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:56:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31807, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.107.134.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:40:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:51:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28648, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.127.252.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:40:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:54:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28640, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.239.217.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T15:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:43:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6379, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.4.135.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:44:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:44:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3187, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.23.102.22", "classifications": [], "first_seen": { "$date": "2023-03-07T15:36:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:06:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 639, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.183.74.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:36:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:21:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 5", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18295, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.178.86.62", "classifications": [], "first_seen": { "$date": "2023-03-07T15:37:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:25:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6381, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "206.42.49.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:38:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T02:05:51Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57254, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.186.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:39:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:13:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146", "ET 3CORESec Poor Reputation IP group 35", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12005, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "43.156.41.19", "classifications": [], "first_seen": { "$date": "2023-03-07T15:39:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:53:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1923, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "189.195.223.42", "classifications": [], "first_seen": { "$date": "2023-03-07T15:43:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T15:43:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 100" ], "sightings": 214, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "150.109.186.152", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T15:52:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:49:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 47161, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.94.230.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:52:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:39:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 167963, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.133.54.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T15:59:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:03:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2409, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.42.163.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:10:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:28:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9285, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.64.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:33:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37887, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.213.120.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:16:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:23:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44541, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.105.21.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T16:16:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:16:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6338, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.200.42.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:17:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:17:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3182, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "50.210.123.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T16:21:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:34:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11067, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.67.170.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T16:44:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:44:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.222.54", "classifications": [], "first_seen": { "$date": "2023-03-07T16:46:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:38:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 72", "ET SCAN Potential SSH Scan" ], "sightings": 10343, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.232.121.81", "classifications": [], "first_seen": { "$date": "2023-03-07T16:47:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:47:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 7" ], "sightings": 210, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.253.28.123", "classifications": [], "first_seen": { "$date": "2023-03-07T16:48:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:46:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3519, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "144.126.204.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T16:50:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T20:51:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27451, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.151.48.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:53:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:53:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6299, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T16:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:55:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12769, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "136.232.79.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:56:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:46:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 93811, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "88.142.46.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:57:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:13:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28277, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.19.24.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:58:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:09:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25151, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.135.163.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:59:55Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:08:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 148", "ET SCAN Potential SSH Scan" ], "sightings": 37951, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "188.166.14.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 98", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32308, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.50.52.106", "classifications": [], "first_seen": { "$date": "2023-03-07T16:51:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:41:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 4134, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.7.207.146", "classifications": [], "first_seen": { "$date": "2023-03-07T16:51:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:48:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 57", "ET SCAN Potential SSH Scan" ], "sightings": 9684, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "210.183.21.48", "classifications": [], "first_seen": { "$date": "2023-03-07T16:53:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 126" ], "sightings": 209, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.99.59.56", "classifications": [], "first_seen": { "$date": "2023-03-07T16:53:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T16:53:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 105" ], "sightings": 209, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.228.65.40", "classifications": [], "first_seen": { "$date": "2023-03-07T16:54:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:45:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139", "ET SCAN Potential SSH Scan" ], "sightings": 10514, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "157.245.137.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T16:54:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:27:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20789, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.12.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T17:00:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:09:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 19289, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.77.151.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T17:05:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:20:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31328, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.128.233.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T17:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:19:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25061, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.140.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T17:07:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:18:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21933, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.76.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T17:08:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:14:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 126720, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.94.138.117", "classifications": [], "first_seen": { "$date": "2023-03-07T17:16:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:16:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 412, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.152.237.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T17:34:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:33:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6272, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.144.11.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T17:35:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T21:21:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7195, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.224.32.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T17:55:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T17:24:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6892, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.9.140.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T17:58:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T17:58:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6232, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "15.207.54.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T18:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:01:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6230, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.36.81.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T18:07:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:28:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12449, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.116.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T18:07:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:00:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12193, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.25.208.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:13:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:46:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26772, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.236.118.222", "classifications": [], "first_seen": { "$date": "2023-03-07T18:11:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:02:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "ET SCAN Potential SSH Scan" ], "sightings": 9947, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "174.138.14.86", "classifications": [], "first_seen": { "$date": "2023-03-07T18:14:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:00:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3982, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.226.248.146", "classifications": [], "first_seen": { "$date": "2023-03-07T18:14:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:14:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 7", "ET SCAN Potential SSH Scan" ], "sightings": 675, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.155.90.118", "classifications": [], "first_seen": { "$date": "2023-03-07T18:17:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:17:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 24", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1005, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.178.30.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:16:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:29:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33896, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.36.139.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:23:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:40:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34105, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.198.110.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:24:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:41:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30993, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.244.43.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:24:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T14:08:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 96576, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.93.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:26:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:38:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27916, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.35.173.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:26:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:13:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 92603, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.249.189.189", "classifications": [], "first_seen": { "$date": "2023-03-07T18:32:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:32:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 26" ], "sightings": 199, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "46.101.2.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:49:27Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 160", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5705, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.129.219.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:34:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:02:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4927, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.117.230.15", "classifications": [], "first_seen": { "$date": "2023-03-07T18:34:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:43:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 144" ], "sightings": 7472, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "155.248.196.28", "classifications": [], "first_seen": { "$date": "2023-03-07T18:34:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:39:14Z" }, "ports": [ 57191, 43684 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 3829, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "52.72.229.236", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T18:34:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:12:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 145585, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "39.90.146.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T18:34:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:34:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6200, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.103.16.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T18:36:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:36:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6189, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.221.60.242", "classifications": [], "first_seen": { "$date": "2023-03-07T18:37:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:37:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 103" ], "sightings": 198, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.136.205.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T18:49:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T18:49:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6180, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.202.216", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-07T18:51:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:30:58Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18144, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "163.172.95.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T19:06:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:54:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8520, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.167.41.167", "classifications": [], "first_seen": { "$date": "2023-03-07T19:13:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:02:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 177", "ET SCAN Potential SSH Scan" ], "sightings": 9522, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "206.189.34.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:14:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:08:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 835, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.146.86.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:14:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:42:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 28", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2031, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.70.81.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:21:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:22:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6150, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.168.135.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:29:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:55:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6125, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "135.181.129.180", "classifications": [], "first_seen": { "$date": "2023-03-07T19:21:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:21:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 195, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "86.57.159.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:30:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:45:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24522, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.66.188.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:31:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:19:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 97577, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.154.202.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:32:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:47:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18391, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.46.9.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T19:32:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:32:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6145, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.118.146.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:33:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:09:55Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 155", "ET SCAN Potential SSH Scan" ], "sightings": 44364, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "205.210.31.41", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-07T19:34:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:47:11Z" }, "ports": [ 0, 80, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 6153, "tags": [ "icmp", "alert", "tcp", "http", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "8.219.233.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:42:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:42:49Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 182" ], "sightings": 107795, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.28.211.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:43:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:32:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 85221, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.197.19.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:44:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:58:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33605, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.241.87.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:44:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:57:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30548, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.119.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:45:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T19:55:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24453, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.216.116.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:56:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:10:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 19644, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.236.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:56:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:10:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33503, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.117.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T19:53:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:34:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 64", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11473, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.40.31.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T20:02:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:02:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "223.13.236.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T20:04:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:04:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6094, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.100.46.164", "classifications": [], "first_seen": { "$date": "2023-03-07T20:04:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:35:05Z" }, "ports": [ 52004, 40281, 58374 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 4949, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "169.239.39.15", "classifications": [], "first_seen": { "$date": "2023-03-07T20:09:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:09:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 191, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.251.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T20:21:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:42:28Z" }, "ports": [ 22, 0 ], "reporting_nodes": 3, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6228, "tags": [ "alert", "tcp", "ssh", "anomaly", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "175.200.140.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T20:35:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:36:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6078, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "145.239.83.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T20:38:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:38:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6078, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.21", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-07T20:52:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:11:01Z" }, "ports": [ 111, 0, 1434 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 14083, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.207.99", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-07T20:52:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T20:52:45Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9104, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.235.24.185", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-07T20:54:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:30:47Z" }, "ports": [ 0, 22, 161 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 15262, "tags": [ "icmp", "ssh", "tcp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.51", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-07T20:56:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:00:21Z" }, "ports": [ 0, 1900, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 13442, "tags": [ "icmp", "udp", "ssh", "tcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "62.80.225.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T21:11:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:11:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6065, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.142.59.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:15:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:33:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36327, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "141.94.76.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:15:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:31:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33308, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.246.37.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:18:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:39:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12108, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.209.187.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:20:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:09:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36510, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.171.43.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:27:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:28:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6116, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.166.180.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:34:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:45:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24193, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.220.67.0", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T21:34:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:34:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6054, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.70.170.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:42:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T21:59:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27188, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.233.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:44:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:02:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 160881, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.248.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:45:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:05:56Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 50", "ET SCAN Potential SSH Scan" ], "sightings": 66694, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.235.24.36", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T21:48:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:13:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19898, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "120.198.151.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T21:49:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:05:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27152, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.239.91.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:12:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:12:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37226, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "76.248.78.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:12:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:44:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62095, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.217.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:14:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:18:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24022, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.122.148.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:16:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:16:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63197, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.93.139.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:16:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:27:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27021, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.56.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:17:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:13:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40636, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.167.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:17:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:27:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21011, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T22:17:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:17:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6018, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.187.178.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:19:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:03:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 89604, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.98.14.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T22:20:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:33:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29959, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.133.40.71", "classifications": [], "first_seen": { "$date": "2023-03-07T22:27:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:52:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6525, "tags": [ "ssh", "tcp", "ssh", "libssh2_1.4.3", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "109.123.232.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T22:38:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:02:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5990, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.208.106.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T22:59:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T22:59:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5969, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T23:03:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:04:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5972, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.80.159.194", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T23:14:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:04:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 146805, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "159.203.240.13", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T23:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:44:41Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7607, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.232.6", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T23:19:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:49:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12462, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.99.202.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T23:29:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:22:55Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6567, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.10.125.209", "classifications": [], "first_seen": { "$date": "2023-03-07T23:31:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:31:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 94" ], "sightings": 178, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "134.122.8.241", "classifications": [], "first_seen": { "$date": "2023-03-07T23:32:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:32:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 31" ], "sightings": 178, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "212.129.52.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T23:36:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:11:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17566, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.224.7", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-07T23:42:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:35:21Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11920, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "80.151.168.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-07T23:45:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:46:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5938, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.80.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T23:51:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:26:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11649, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.238.63.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-07T23:57:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-07T23:57:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5934, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.237.37.113", "classifications": [], "first_seen": { "$date": "2023-03-08T00:03:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:03:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 352, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "221.214.211.122", "classifications": [], "first_seen": { "$date": "2023-03-08T00:04:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:04:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 528, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.79.128.205", "classifications": [], "first_seen": { "$date": "2023-03-08T00:17:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:10:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1293, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.5.9.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T00:18:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:18:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 59" ], "sightings": 5934, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.167.96.138", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T00:26:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:36:54Z" }, "ports": [ 162, 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 2966, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.176.24.2", "classifications": [], "first_seen": { "$date": "2023-03-08T00:26:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:26:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 2960, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.102.74.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T00:27:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:40:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17747, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.94.138.36", "classifications": [], "first_seen": { "$date": "2023-03-08T00:35:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:35:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 348, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.107.53.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T00:39:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:39:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5914, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.77.245.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T00:42:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:21:56Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 165", "ET SCAN Potential SSH Scan" ], "sightings": 30053, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "194.165.137.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T00:44:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:59:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26560, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.1.228.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T00:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:57:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20658, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.234.125.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T00:52:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:52:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2951, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.171.89.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T00:54:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:54:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.194.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T00:55:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:55:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.224.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T00:57:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:57:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.88.129.212", "classifications": [], "first_seen": { "$date": "2023-03-08T00:52:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T00:52:11Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 21" ], "sightings": 172, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.172.0.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T01:09:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:09:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 20600, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "104.248.197.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T01:16:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:03:53Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12", "ET 3CORESec Poor Reputation IP group 3", "ET SCAN Potential SSH Scan" ], "sightings": 31636, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "119.65.149.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T01:17:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:56:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23675, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "145.239.144.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T01:18:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:32:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29321, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "75.67.114.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T01:19:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:31:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23459, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.178.167.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T01:21:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:07:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174" ], "sightings": 87851, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.234.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T01:30:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:45:10Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4504, "tags": [ "alert", "tcp", "ssh", "Go", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "123.195.33.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T01:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:52:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29874, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.104.114.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T01:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:09:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11373, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.174.243.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T01:37:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:32:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10341, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.252.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T01:38:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:16:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19211, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.96.70", "classifications": [], "first_seen": { "$date": "2023-03-08T01:35:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:35:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 338, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "193.163.125.194", "classifications": [], "first_seen": { "$date": "2023-03-08T01:40:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:40:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 169, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "37.34.55.104", "classifications": [], "first_seen": { "$date": "2023-03-08T01:50:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:50:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 5816, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "184.105.139.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T01:50:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:49:54Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 59806, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.62.193.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T01:53:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:03:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23214, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.108.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T01:53:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T17:26:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37581, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.194.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T01:55:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:38:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 133262, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.70.177.135", "classifications": [], "first_seen": { "$date": "2023-03-08T01:55:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T01:55:41Z" }, "ports": [ 8083 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 5808, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.144.148.213", "classifications": [], "first_seen": { "$date": "2023-03-08T01:58:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:59:09Z" }, "ports": [ 42914, 54072 ], "reporting_nodes": 2, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", "(http_inspect) URI has percent-encoding of an unreserved character" ], "sightings": 2369, "tags": [ "alert", "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.61.187.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T02:08:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:21:20Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) partial start line" ], "sightings": 12983, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "223.8.221.255", "classifications": [], "first_seen": { "$date": "2023-03-08T02:20:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:20:17Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 5782, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "216.218.206.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T02:24:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:37:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5794, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.100.160.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T02:28:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:30:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5779, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.197.144.104", "classifications": [], "first_seen": { "$date": "2023-03-08T02:21:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T03:08:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3467, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.160.96.242", "classifications": [], "first_seen": { "$date": "2023-03-08T02:22:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:23:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 498, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.183.132.72", "classifications": [], "first_seen": { "$date": "2023-03-08T02:23:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:23:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174" ], "sightings": 166, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.29.109.74", "classifications": [], "first_seen": { "$date": "2023-03-08T02:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:36:32Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 5775, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.175.44.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T02:43:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:02:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 87054, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.101.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T02:44:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:52:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 71", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2094, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.46.51.179", "classifications": [], "first_seen": { "$date": "2023-03-08T02:47:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:57:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 493, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "111.12.127.5", "classifications": [], "first_seen": { "$date": "2023-03-08T02:48:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T03:04:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 494, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "94.131.109.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T02:46:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:05:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.74.10.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T02:53:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:53:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5766, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.43.145.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T02:59:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:01:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Timestamp Request", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP Timestamp Reply" ], "sightings": 51680, "tags": [ "icmp" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "46.147.193.234", "classifications": [], "first_seen": { "$date": "2023-03-08T02:56:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T02:58:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 5576, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "86.9.201.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:01:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T03:01:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5762, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.21.226.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:11:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T03:11:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5762, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.70.88.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:27:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T03:44:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 107", "ET SCAN Potential SSH Scan" ], "sightings": 37476, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "150.136.89.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:28:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T03:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34431, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.52.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:28:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T03:44:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28692, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.247.152.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:29:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T22:09:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25927, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T03:31:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:21:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7020, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.234.80.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:32:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T16:52:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 23" ], "sightings": 17224, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.157.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T03:34:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:45:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9067, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.104.172.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:34:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:28:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10206, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.232.155.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:37:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:10:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66021, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.236.244.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T03:37:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:44:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6089, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "139.59.92.30", "classifications": [], "first_seen": { "$date": "2023-03-08T03:39:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:36:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3023, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "119.36.113.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T03:54:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:18:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9507, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.203.213.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:11:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:30:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5854, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.2", "classifications": [], "first_seen": { "$date": "2023-03-08T04:14:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:15:54Z" }, "ports": [ 40179, 23700 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 5716, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "39.65.67.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T04:15:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:15:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5715, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.131.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:23:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:54:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54072, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T04:24:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:09:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.243.35.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:25:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:49:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44372, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.246", "classifications": [ "Misc activity", "Attempted Information Leak", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-08T04:26:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:05:24Z" }, "ports": [ 0, 177, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 26629, "tags": [ "icmp", "udp", "xdmcp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "162.243.130.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T04:36:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:36:16Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8541, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "118.201.79.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:43:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:33:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25978, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.217.174", "classifications": [], "first_seen": { "$date": "2023-03-08T04:36:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:36:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 43" ], "sightings": 156, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.255.113.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:38:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:20:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5574, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.36.10.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:43:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:34:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18206, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.154.42.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:43:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:02:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11099, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.46.28.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:48:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:33:06Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET 3CORESec Poor Reputation IP group 7", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7296, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "220.121.89.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T04:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:46:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5690, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.192.111.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T04:53:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T04:53:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP Timestamp Request", "PROTOCOL-ICMP Timestamp Reply" ], "sightings": 51143, "tags": [ "icmp" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "162.142.125.216", "classifications": [], "first_seen": { "$date": "2023-03-08T05:00:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:35:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 351, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "175.23.169.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T05:01:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:15:52Z" }, "ports": [ 22, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 101734, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "68.69.184.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T05:10:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:12:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 45943, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.232.173.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T05:13:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:28:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25369, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "77.243.181.54", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T05:14:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:07:07Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18113, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.12.229.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T05:16:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T23:10:21Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 24255, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.36.234.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T05:17:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:16:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 47292, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.24.79", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-08T05:20:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:48:41Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21808, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "218.12.116.26", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T05:26:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:51:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 14120, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "61.227.218.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T05:30:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:30:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5634, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.30.154.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T05:31:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:10:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6918, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.203.118.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T05:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:36:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5632, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.135.118.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T05:44:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:58:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28078, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.236.103.26", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T05:45:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:35:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 73588, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "124.120.19.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T05:49:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T05:49:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11238, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.236.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T05:53:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:20:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8071, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.102.82.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T06:03:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:48:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 91345, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.151.17", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T06:03:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:33:42Z" }, "ports": [ 0, 162 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 8999, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "ff02::16", "classifications": [], "first_seen": { "$date": "2023-03-08T06:04:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:54:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected" ], "sightings": 10216, "tags": [ "ipv6-icmp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "3.87.52.122", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T06:04:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:05:09Z" }, "ports": [ 1723, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 8411, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "146.190.52.81", "classifications": [], "first_seen": { "$date": "2023-03-08T06:16:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:05:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49", "ET SCAN Potential SSH Scan" ], "sightings": 7512, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.186.0.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T06:16:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:21:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 5", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6227, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "136.228.167.28", "classifications": [], "first_seen": { "$date": "2023-03-08T06:16:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:14:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3085, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.157.3.106", "classifications": [], "first_seen": { "$date": "2023-03-08T06:17:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:56:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 154", "ET 3CORESec Poor Reputation IP group 35" ], "sightings": 8991, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.101.207.32", "classifications": [], "first_seen": { "$date": "2023-03-08T06:17:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:17:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 160" ], "sightings": 149, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "206.189.129.144", "classifications": [], "first_seen": { "$date": "2023-03-08T06:19:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:13:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 121", "ET SCAN Potential SSH Scan" ], "sightings": 7635, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.206.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:15:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:42:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8981, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:16:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:33:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6924, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.190.62.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T06:28:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:28:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5600, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.87.236.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T06:28:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:43:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22360, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.192.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:31:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:31:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.59.151.115", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:31:23Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11196, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.132.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T14:54:33Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 10315, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.133.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:35:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:58:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7680, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.117.74.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T06:35:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:36:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5594, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:09:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15549, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.118.220", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:43:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:43:29Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8376, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "92.63.196.140", "classifications": [], "first_seen": { "$date": "2023-03-08T06:44:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:45:22Z" }, "ports": [ 8089, 5001 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 5581, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "47.95.238.78", "classifications": [], "first_seen": { "$date": "2023-03-08T06:37:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:37:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 294, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "94.130.68.7", "classifications": [], "first_seen": { "$date": "2023-03-08T06:49:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:49:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 147, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.236.128.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:46:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:46:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8594, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.200.7.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T06:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T06:54:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.215.180.241", "classifications": [], "first_seen": { "$date": "2023-03-08T07:13:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:13:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 144, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "129.226.207.190", "classifications": [], "first_seen": { "$date": "2023-03-08T07:14:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:06:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 3272, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "222.78.41.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T07:22:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:22:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.195.31.102", "classifications": [], "first_seen": { "$date": "2023-03-08T07:32:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:16:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 769, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "120.158.67.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T07:33:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:33:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5568, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.240.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T07:34:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:10:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44116, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.50.21.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T07:37:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:38:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16692, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.70.208.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T07:40:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:20:43Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3141, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.205.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T07:42:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:42:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.44.238.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T07:56:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:28:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(tcp) TCP port 0 traffic" ], "sightings": 14339, "tags": [ "icmp", "tcp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "95.141.36.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T07:57:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T07:57:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.31.129.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T08:00:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:16:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 18773, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "149.18.73.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T08:07:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:51:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25013, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.5.145.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T08:13:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:08:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24981, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.64.73.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T08:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:52:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10343, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.3.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T08:14:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:47:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 82373, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.152.177.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T08:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:31:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22040, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.224.81.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T08:21:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:38:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24751, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.35.140.244", "classifications": [], "first_seen": { "$date": "2023-03-08T08:23:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:23:15Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2757, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "82.66.77.8", "classifications": [], "first_seen": { "$date": "2023-03-08T08:22:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:22:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 278, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "206.189.233.82", "classifications": [], "first_seen": { "$date": "2023-03-08T08:27:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:27:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 122" ], "sightings": 139, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T08:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:29:49Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 8866, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.115.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T08:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:34:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.150.188.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T08:40:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:40:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5490, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.139.169.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T08:57:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:10:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4730, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.98.194.27", "classifications": [], "first_seen": { "$date": "2023-03-08T08:58:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T08:58:25Z" }, "ports": [ 445 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 5480, "tags": [ "tcp", "smb" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.157.43.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T09:02:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:45:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51854, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.8.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T09:03:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:19:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 24605, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "96.43.143.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T09:03:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:30:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10922, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.227.76.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T09:05:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:17:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24607, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.98.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T09:07:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:19:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27329, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.104.11.214", "classifications": [], "first_seen": { "$date": "2023-03-08T09:14:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:07:53Z" }, "ports": [ 8083, 58603, 8081, 4433, 4443, 8088, 7443, 8080 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 10474, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "92.63.196.5", "classifications": [], "first_seen": { "$date": "2023-03-08T09:24:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:42:47Z" }, "ports": [ 33398, 33363, 33312, 33335, 33287, 33280, 33429 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 13791, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "223.15.11.50", "classifications": [], "first_seen": { "$date": "2023-03-08T09:49:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T09:49:36Z" }, "ports": [ 88 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 5432, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "2.235.184.98", "classifications": [], "first_seen": { "$date": "2023-03-08T10:04:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:04:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 4" ], "sightings": 399, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "75.18.117.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T10:00:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:54:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7120, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.222.211.114", "classifications": [], "first_seen": { "$date": "2023-03-08T10:15:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T11:09:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2995, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "123.157.77.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T10:16:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:57:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7018, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.27.60.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T10:16:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:03:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 86", "ET 3CORESec Poor Reputation IP group 20", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5649, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "65.49.20.72", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-08T10:17:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:22:00Z" }, "ports": [ 80, 69, 0, 1900 ], "reporting_nodes": 3, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 68", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 9998, "tags": [ "alert", "tcp", "http", "udp", "tftp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "203.69.37.212", "classifications": [], "first_seen": { "$date": "2023-03-08T10:20:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:20:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 142, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.145.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T10:21:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:21:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5412, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.191.233.185", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-08T10:23:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:15:14Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39749, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.201.87.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T10:35:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:06:17Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 88179, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.137.10.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T10:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T10:49:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21584, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.139.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T10:45:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:54:01Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32266, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "5.252.178.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T10:58:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:12:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10722, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.185.203.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T11:00:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:56:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6182, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2600:9000:24f4:0e00:0000:df71:8000:93a1", "classifications": [], "first_seen": { "$date": "2023-03-08T11:41:46Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-03-08T11:41:46Z" }, "ports": [ 49124 ], "reporting_nodes": 1, "rules": [], "sightings": 127, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.148.122.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T11:33:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T11:33:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5364, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.93.57.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T11:34:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T11:34:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5364, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "108.80.30.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T11:45:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T11:47:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5392, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.228.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T11:59:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:08:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10288, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.64.76", "classifications": [], "first_seen": { "$date": "2023-03-08T12:08:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:08:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62" ], "sightings": 126, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.164.220.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T12:08:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T20:47:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10298, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.134.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T12:08:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:08:14Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8033, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "178.79.186.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T12:10:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:35:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10544, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.201.78.253", "classifications": [], "first_seen": { "$date": "2023-03-08T12:12:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:25:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 28", "ET SCAN Potential SSH Scan" ], "sightings": 4183, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "5.252.176.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T12:42:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:37:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10433, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.170.145.168", "classifications": [], "first_seen": { "$date": "2023-03-08T12:30:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:50:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1240, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.227.123.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T12:31:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:17:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 71", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6535, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "157.245.154.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T12:32:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:41:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2104, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.101.126.19", "classifications": [], "first_seen": { "$date": "2023-03-08T12:35:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:34:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 119" ], "sightings": 4558, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "158.160.42.227", "classifications": [], "first_seen": { "$date": "2023-03-08T12:37:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T12:49:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 744, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "157.245.108.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T13:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:52:37Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32830, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.68.178.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T13:08:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:07:46Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 36", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28529, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "89.248.165.46", "classifications": [], "first_seen": { "$date": "2023-03-08T13:11:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:31:13Z" }, "ports": [ 22, 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 247, "tags": [ "alert", "tcp", "ssh", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.152.57.24", "classifications": [], "first_seen": { "$date": "2023-03-08T13:15:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:15:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 123, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.163.45.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:10:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:10:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5340, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.224.11", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:10:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:47:28Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3474, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "210.106.108.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T13:23:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:02:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 125", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44418, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.163.209.91", "classifications": [], "first_seen": { "$date": "2023-03-08T13:25:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:07:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1579, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "150.109.205.234", "classifications": [], "first_seen": { "$date": "2023-03-08T13:26:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:20:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 51", "ET SCAN Potential SSH Scan" ], "sightings": 6042, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "210.179.113.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T13:17:55Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T10:18:26Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6861, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.224.96.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:19:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:19:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5335, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.226.58.126", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:19:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:59:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13338, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.217.35.100", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-03-08T13:22:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:22:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-ICMP PING Windows", "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13313, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.10.246.212", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T13:22:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:45:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 51809, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.142.125.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:25:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:05:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7820, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.187.254.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:25:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:25:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5320, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.177.191.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:28:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:19:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10066, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.158.244.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:29:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:29:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5312, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.44.238.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:33:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:33:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5308, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.28.194.18", "classifications": [], "first_seen": { "$date": "2023-03-08T13:53:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:53:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 21" ], "sightings": 121, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.130.88.199", "classifications": [], "first_seen": { "$date": "2023-03-08T13:53:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:53:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 37" ], "sightings": 121, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "27.255.79.227", "classifications": [], "first_seen": { "$date": "2023-03-08T13:54:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:14:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1200, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "195.211.46.193", "classifications": [], "first_seen": { "$date": "2023-03-08T13:56:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:56:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 108", "ET 3CORESec Poor Reputation IP group 25" ], "sightings": 242, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "27.112.78.168", "classifications": [], "first_seen": { "$date": "2023-03-08T13:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:56:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 135" ], "sightings": 4759, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.153.12.98", "classifications": [], "first_seen": { "$date": "2023-03-08T13:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:39:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2145, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.156.106.29", "classifications": [], "first_seen": { "$date": "2023-03-08T13:56:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:51:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2736, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.199.95.142", "classifications": [], "first_seen": { "$date": "2023-03-08T13:57:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T13:57:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139" ], "sightings": 121, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "65.21.6.19", "classifications": [], "first_seen": { "$date": "2023-03-08T13:58:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:44:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2625, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "38.93.247.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T13:59:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:58:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13495, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.153.11.185", "classifications": [], "first_seen": { "$date": "2023-03-08T14:05:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:36:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 476, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.223.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T14:00:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:00:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5296, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.20.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T14:12:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:57:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10368, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.122.13.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T14:15:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:15:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5288, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.30.249.87", "classifications": [], "first_seen": { "$date": "2023-03-08T14:36:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:44:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 23" ], "sightings": 4551, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.28.234.131", "classifications": [], "first_seen": { "$date": "2023-03-08T14:41:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:55:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 235, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.215.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T14:46:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:46:16Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10554, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.239.19", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T14:46:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:46:20Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10552, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "76.167.17.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T14:47:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T14:47:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 5275, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.230.167.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T14:52:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:57:08Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157", "ET 3CORESec Poor Reputation IP group 36" ], "sightings": 139124, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "51.142.215.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T14:52:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:39:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 80475, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.251.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T14:58:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:13:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21005, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.92.225", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T14:58:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:00:32Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 12132, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "89.163.130.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T14:59:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:13:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26254, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.80.48.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:00:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:00:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2631, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.247.10.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:03:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:09:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 131" ], "sightings": 94533, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.130.214.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:04:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:15:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13111, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.184.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:05:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:19:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20933, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.95.63.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:06:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:06:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.72.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:07:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:56:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34646, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.219.248.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:08:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:05:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77682, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "13.234.178.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:08:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:00:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77769, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.170.68.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:09:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:09:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5249, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.244.144.191", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:10:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:52:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7546, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.174.11", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:14:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:09:14Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20714, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.136.51.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:15:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:15:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13069, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "107.170.234.12", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T15:19:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:37:03Z" }, "ports": [ 0, 22, 162 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload", "PROTOCOL-SNMP trap tcp" ], "sightings": 5735, "tags": [ "icmp", "tcp", "ssh", "snmptrap" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "115.219.146.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:27:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:27:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5203, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.175.215.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:38:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T20:00:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.42.156.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:38:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:38:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5188, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.38.242.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:39:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:51:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20642, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.26.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:40:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:53:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23209, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.199.235.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:40:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:55:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23196, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.77.151.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T15:42:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:52:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20633, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.64.97.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:43:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5177, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.21.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:51:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:36:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.247.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T15:58:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.52.75.93", "classifications": [], "first_seen": { "$date": "2023-03-08T15:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T15:56:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 114, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "93.32.76.1", "classifications": [], "first_seen": { "$date": "2023-03-08T16:15:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:16:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 8183, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.5", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.220.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:04:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:04:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5130, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.239.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:07:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:47:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8695, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.87.109.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:11:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:11:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5126, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.116.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:11:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:54:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8061, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.144.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:14:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:25:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8587, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.220.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:23:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:53:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.133.10.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:29:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:29:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5120, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.173.114.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:36:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:36:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.232.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:40:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:40:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5116, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:18:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7423, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.224.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:57:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:25:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15226, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.94.80.32", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T16:57:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T16:57:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12782, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "134.209.254.251", "classifications": [], "first_seen": { "$date": "2023-03-08T17:12:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:12:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 110, "tags": [ "ssh", "tcp", "ssh", "Go", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.154.12.139", "classifications": [], "first_seen": { "$date": "2023-03-08T17:30:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:30:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 156" ], "sightings": 110, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "202.53.169.98", "classifications": [], "first_seen": { "$date": "2023-03-08T17:30:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:36:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 119" ], "sightings": 4105, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.111.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T17:09:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:22:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5116, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.73.161.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T17:19:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:25:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17910, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.126.226.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T17:44:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:10:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8017, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.187.147.214", "classifications": [], "first_seen": { "$date": "2023-03-08T17:45:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:42:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 6", "ET SCAN Potential SSH Scan" ], "sightings": 5366, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "185.169.183.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T17:45:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:41:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55127, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.21.20.152", "classifications": [], "first_seen": { "$date": "2023-03-08T17:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:46:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 327, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.156.43.87", "classifications": [], "first_seen": { "$date": "2023-03-08T17:47:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:39:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2364, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "42.200.212.120", "classifications": [], "first_seen": { "$date": "2023-03-08T17:54:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:45:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 35", "ET SCAN Potential SSH Scan" ], "sightings": 2462, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.235.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T17:32:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:58:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5134, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.42.32.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T17:44:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:10:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30959, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.89.47.109", "classifications": [], "first_seen": { "$date": "2023-03-08T17:58:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:14:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 751, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "117.2.49.125", "classifications": [], "first_seen": { "$date": "2023-03-08T18:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:00:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 19" ], "sightings": 108, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.222.193.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:01:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:29:42Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17566, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.32.21.67", "classifications": [], "first_seen": { "$date": "2023-03-08T18:04:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:16:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 749, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "187.191.60.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:04:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:21:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 97", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3119, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.234.5", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T17:54:10Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:46:47Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9928, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "159.203.224.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T17:54:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:56:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5690, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.234.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T17:54:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:33:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6726, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.27", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T17:54:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:37:42Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15179, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "211.193.63.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T17:55:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T17:57:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5078, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.34.4.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T18:02:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:02:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5074, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.236.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T18:14:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:00:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5114, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.83.196", "classifications": [], "first_seen": { "$date": "2023-03-08T18:45:32Z" }, "ja3": [ "19e29534fd49dd27d09234e639c4057e" ], "last_seen": { "$date": "2023-03-08T18:45:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "REQUEST_BODY_UNEXPECTED", "SURICATA HTTP Unexpected Request body" ], "sightings": 636, "tags": [ "alert", "tcp", "ssh", "anomaly", "tls", "http" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "34.102.25.11", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-08T18:21:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:21:21Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7601, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "89.248.163.209", "classifications": [], "first_seen": { "$date": "2023-03-08T18:35:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:38:03Z" }, "ports": [ 12389, 9000, 5555, 3001 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 7602, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.111.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T18:39:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:32:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9421, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T18:39:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:39:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.68.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:42:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:55:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20183, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.90.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:43:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:19:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 75317, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "217.165.156.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T18:43:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:43:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5060, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.138.45.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:49:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:14:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1694, "tags": [ "ssh", "tcp", "ssh", "ZGrab", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.119.231.13", "classifications": [], "first_seen": { "$date": "2023-03-08T18:55:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:55:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187" ], "sightings": 105, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.219.167.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:57:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:16:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18678, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "207.154.212.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:58:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:01:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4976, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.58.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:58:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:36:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 150", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24439, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "115.78.237.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:45:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T18:07:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49600, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.65.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:50:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:05:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 29457, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.69.55.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T18:50:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T18:02:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 59975, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T18:58:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T18:58:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5037, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.120.45.208", "classifications": [], "first_seen": { "$date": "2023-03-08T19:25:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:25:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 208, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "124.61.19.83", "classifications": [], "first_seen": { "$date": "2023-03-08T19:36:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:36:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 208, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.4p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "219.147.85.159", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T19:01:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:09:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 41130, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "61.177.173.46", "classifications": [], "first_seen": { "$date": "2023-03-08T19:01:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:01:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) server version string overflow" ], "sightings": 2509, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.201.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T19:07:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:46:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6928, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.144.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T19:10:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:17:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5028, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.0.109.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T19:11:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:11:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5006, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.123.168.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T19:15:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:16:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5000, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.146.13.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T19:20:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:22:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4992, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.255.228.29", "classifications": [], "first_seen": { "$date": "2023-03-08T19:21:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:19:36Z" }, "ports": [ 8081, 8008, 3306, 10443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 6112, "tags": [ "tcp", "mysql" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "72.14.184.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T19:22:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:15:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9869, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.175.215.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T19:28:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T20:23:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9948, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.137", "classifications": [], "first_seen": { "$date": "2023-03-08T19:34:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:36:26Z" }, "ports": [ 3318, 7899, 1022 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 7469, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.193.69.48", "classifications": [], "first_seen": { "$date": "2023-03-08T19:42:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:43:23Z" }, "ports": [ 37215, 8083 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 6572, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "223.9.42.130", "classifications": [], "first_seen": { "$date": "2023-03-08T19:44:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:44:32Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 4978, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.36.22.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T20:18:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:11:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 7", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1532, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.207.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T19:47:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:03:41Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 5028, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.208.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T19:51:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:01:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22629, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.94.82.42", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-08T19:53:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:53:22Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7457, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "195.178.151.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T19:53:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T19:53:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4972, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.78.7.110", "classifications": [], "first_seen": { "$date": "2023-03-08T20:02:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T20:40:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 9917, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "89.216.130.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T20:03:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T14:33:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.180.123.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T20:10:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T20:11:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4964, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.216.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T20:16:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T20:16:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4958, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.83.80", "classifications": [], "first_seen": { "$date": "2023-03-08T21:20:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:08:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 55", "ET SCAN Potential SSH Scan" ], "sightings": 4881, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.142.125.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T20:33:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:15:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4964, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.54.149.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T20:45:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:16:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 107518, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.51.132", "classifications": [], "first_seen": { "$date": "2023-03-08T21:20:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:08:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1846, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.252.5", "classifications": [], "first_seen": { "$date": "2023-03-08T21:21:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:48:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 15" ], "sightings": 105, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "96.241.115.117", "classifications": [], "first_seen": { "$date": "2023-03-08T21:21:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:10:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1941, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.140.204.169", "classifications": [], "first_seen": { "$date": "2023-03-08T21:22:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:12:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2034, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "223.171.46.146", "classifications": [], "first_seen": { "$date": "2023-03-08T21:24:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:37:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 133" ], "sightings": 3368, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "206.189.57.56", "classifications": [], "first_seen": { "$date": "2023-03-08T21:24:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T12:22:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 122", "ET SCAN Potential SSH Scan" ], "sightings": 1908, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "159.65.129.227", "classifications": [], "first_seen": { "$date": "2023-03-08T21:24:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:24:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61" ], "sightings": 99, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.248.150.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T21:24:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:37:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12", "ET 3CORESec Poor Reputation IP group 3", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9057, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "111.12.126.244", "classifications": [], "first_seen": { "$date": "2023-03-08T21:28:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:42:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 291, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.125.21.52", "classifications": [], "first_seen": { "$date": "2023-03-08T21:29:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:44:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 776, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "137.184.35.122", "classifications": [], "first_seen": { "$date": "2023-03-08T21:29:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:29:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34" ], "sightings": 97, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.140.198.226", "classifications": [], "first_seen": { "$date": "2023-03-08T21:32:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:23:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2117, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.40.181.23", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:01:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:56:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15590, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "180.131.126.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:03:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:50:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 5722, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.130.96.154", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:03:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:03:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12326, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.138.11", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T21:06:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:08:35Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 7738, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.227.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:06:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:06:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4928, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.101.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T21:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:25:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19660, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.143.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T21:11:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:25:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24576, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.228.249.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T21:12:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:23:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19661, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.188.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T21:12:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:43:17Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 38" ], "sightings": 29895, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.129.75.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T21:13:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:24:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19657, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.232.46.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T21:13:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:51:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45116, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.55.164.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T21:14:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:51:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 73526, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.193.255.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:20:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:04:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27521, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.148.75", "classifications": [], "first_seen": { "$date": "2023-03-08T21:21:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:10:49Z" }, "ports": [ 9000, 8088, 9443, 8081, 10443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 5593, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.64.75.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:28:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:02:23Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 96567, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "203.243.54.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T22:09:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T22:27:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1274, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "200.73.132.27", "classifications": [], "first_seen": { "$date": "2023-03-08T22:13:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:36:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 470, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "49.169.63.208", "classifications": [], "first_seen": { "$date": "2023-03-08T22:22:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:19:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Last ACK with wrong seq", "ET SCAN Potential SSH Scan" ], "sightings": 2039, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.135.145.254", "classifications": [], "first_seen": { "$date": "2023-03-08T22:23:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:23:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 147" ], "sightings": 95, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "195.224.91.238", "classifications": [], "first_seen": { "$date": "2023-03-08T22:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:25:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 108" ], "sightings": 95, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.83.131.123", "classifications": [], "first_seen": { "$date": "2023-03-08T22:26:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:18:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 166", "ET SCAN Potential SSH Scan" ], "sightings": 4803, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.9.159.153", "classifications": [], "first_seen": { "$date": "2023-03-08T22:26:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:26:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 9" ], "sightings": 95, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.185.38.33", "classifications": [], "first_seen": { "$date": "2023-03-08T22:31:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:36:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 11746, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "145.14.176.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:45:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:45:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "145.14.176.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:47:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:47:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.13.80.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:47:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T21:47:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.91.98.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T21:50:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:25:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8172, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.129.209.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T22:00:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:00:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4886, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.3.105.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T22:00:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:09:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 24" ], "sightings": 19543, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.230.65.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T22:01:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:51:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 122923, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.185.123.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T22:09:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:01:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9727, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.182.113.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T22:12:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:27:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24348, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "85.208.107.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T22:13:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:27:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9738, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.52.101.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T22:14:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:14:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4880, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.138.132.54", "classifications": [], "first_seen": { "$date": "2023-03-08T22:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:55:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 8648, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "82.66.122.211", "classifications": [], "first_seen": { "$date": "2023-03-08T22:40:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:48:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 264, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "54.86.1.44", "classifications": [], "first_seen": { "$date": "2023-03-08T22:55:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:55:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 92, "tags": [ "ssh", "tcp", "ssh", "paramiko_2.9.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "92.63.196.8", "classifications": [], "first_seen": { "$date": "2023-03-08T22:20:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:23:00Z" }, "ports": [ 28148, 49892, 23169 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 7303, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "18.130.168.182", "classifications": [], "first_seen": { "$date": "2023-03-08T22:23:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:23:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 2432, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.136.152.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T22:23:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:23:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12163, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "114.40.138.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T22:27:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:27:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4861, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "168.205.48.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T22:42:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:21:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14018, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.15.63.176", "classifications": [], "first_seen": { "$date": "2023-03-08T23:27:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:38:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 6366, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "31.46.16.122", "classifications": [], "first_seen": { "$date": "2023-03-08T23:30:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:30:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 136" ], "sightings": 91, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.72.163.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T23:32:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:17:36Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35470, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.39.66.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T22:53:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:53:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4845, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.69.60.214", "classifications": [], "first_seen": { "$date": "2023-03-08T22:59:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T22:59:25Z" }, "ports": [ 2382 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2423, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.120.253.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T23:04:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:04:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4843, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.115.85.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T23:09:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:09:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4840, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.151.39", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-08T23:14:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:14:37Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7256, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.138.16.192", "classifications": [], "first_seen": { "$date": "2023-03-08T23:50:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:52:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1620, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "120.48.34.173", "classifications": [], "first_seen": { "$date": "2023-03-08T23:54:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:56:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 5040, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "98.142.141.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T23:23:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:38:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 193484, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.177.173.47", "classifications": [], "first_seen": { "$date": "2023-03-08T23:23:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:23:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) server version string overflow" ], "sightings": 2417, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.229.5", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-08T23:23:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:19:52Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 4898, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.79.181.94", "classifications": [], "first_seen": { "$date": "2023-03-09T00:18:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:18:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 394, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.93.216.8", "classifications": [], "first_seen": { "$date": "2023-03-09T00:21:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:21:25Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 21" ], "sightings": 89, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.226.22", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-08T23:31:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:48:56Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 7590, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.224.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T23:35:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:34:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4887, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.136.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-08T23:36:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:52:13Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 8302, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "218.37.76.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T23:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-08T23:45:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4826, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.220.38.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T23:48:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:05:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26450, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.133.39.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T23:50:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:13:20Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146", "ET SCAN Potential SSH Scan" ], "sightings": 28047, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "159.223.45.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-08T23:52:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:37:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29289, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T00:30:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:37:37Z" }, "ports": [ 22, 80, 0 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 327, "tags": [ "alert", "tcp", "ssh", "Go", "http", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "95.214.27.161", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-09T00:01:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:03:32Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 89451, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.141.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T00:01:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:01:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4808, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.3.116.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T00:02:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:15:24Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 30042, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T00:02:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:02:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4802, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.80.40.160", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T00:09:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:09:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 35987, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.82.47.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T00:23:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:12:57Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11927, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "167.94.138.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T00:27:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:55:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11073, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.238.29.117", "classifications": [], "first_seen": { "$date": "2023-03-09T00:30:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T01:37:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 8687, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "65.49.20.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T00:47:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:54:34Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 7705, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "68.70.242.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T00:51:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T00:51:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4792, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.10.86.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T00:54:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:08:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16749, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "24.199.92.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T00:56:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:10:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21529, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.131.24.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T00:57:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:11:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23916, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.10.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T00:57:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:49:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 89284, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.4.248.206", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T01:03:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:32:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 29435, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "65.49.20.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T01:06:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:40:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T01:37:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:07:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6338, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.97.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T01:37:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:19:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17948, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.62.22.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T01:59:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:20:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4763, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.142.156.201", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-09T01:59:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:39:09Z" }, "ports": [ 0, 1900, 161, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 252066, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "161.35.230.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T02:02:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:48:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13160, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.218", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-09T02:02:08Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:58:09Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 16596, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "161.35.238.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T02:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:54:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14045, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.161.55.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T02:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:44:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10327, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.133.26.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T02:06:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:48:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22203, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T02:10:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:16:46Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 6502, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "129.151.84.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T02:24:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:09:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9498, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.185.238.72", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-09T02:25:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:03:54Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 49773, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "115.134.9.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T02:41:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:56:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21271, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "72.240.125.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T02:44:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:41:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27665, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.237.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T02:44:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:26:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21627, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.240.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T02:45:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:37:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23675, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.90.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T02:46:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:27:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 75898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.215.52.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T02:50:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:50:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4730, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.73", "classifications": [], "first_seen": { "$date": "2023-03-09T02:51:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:52:51Z" }, "ports": [ 25059, 62280 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4726, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.101.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T03:03:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:19:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12588, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "150.117.210.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T03:07:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:09:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4718, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.143.246.30", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-09T03:10:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:10:15Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7077, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.207.44", "classifications": [ "Misc activity", "Decode of an RPC Query", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-09T03:23:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:00:48Z" }, "ports": [ 1434, 0, 111, 53 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-DNS named version attempt" ], "sightings": 7283, "tags": [ "udp", "icmp", "sunrpc", "portmapper" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "107.170.243.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T03:24:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:55:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17047, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.232.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T03:28:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:00:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9401, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.231.186.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T03:36:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:41:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7323, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.188.180.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T03:38:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:38:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4702, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.38.251.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T03:39:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:05:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14093, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.143.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T03:45:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:45:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4702, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.67", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-09T03:45:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:58:07Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 15885, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "183.238.0.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T03:55:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:13:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14073, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.75.133.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T03:56:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:40:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34266, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.36.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T03:59:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:10:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21124, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.14.133.50", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T04:00:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:49:13Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20298, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T04:03:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:03:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4695, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.134.144.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T04:15:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:00:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18359, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.208.236.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T04:19:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:19:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "136.228.161.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T04:37:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:49:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 70022, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.238.208.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T04:42:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:42:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4680, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.244.202.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T04:50:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:50:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4672, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.80.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:00:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:13:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18658, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.94.138.141", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-09T05:05:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:06:59Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get" ], "sightings": 4683, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T05:09:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T00:19:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9943, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.95.24.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:16:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:31:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18635, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "174.251.240.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T05:21:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:21:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4659, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.164.93.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:28:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:29:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4657, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.180.33.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:35:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:30:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 88195, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.34.17.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:36:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:37:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4655, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.12.115.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:38:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:49:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13949, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.148.67.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:42:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:23:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 48" ], "sightings": 69476, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.162.30.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:57:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18571, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.190.209.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:44:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:44:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2325, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.227.172.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:47:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:58:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18566, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.28.209.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T05:48:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:37:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 43965, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "3.237.76.136", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-09T05:53:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:54:03Z" }, "ports": [ 113, 161, 2015, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 9279, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "144.22.181.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T05:53:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:53:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4640, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.193.50.6", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T06:15:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:15:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 23094, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "167.94.138.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T06:16:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:18:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4623, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.211.234.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T06:44:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:44:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4612, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.255.109.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T06:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T22:33:56Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 168" ], "sightings": 27649, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.160.240.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T06:47:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:56:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 86061, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.9.140.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T06:54:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:54:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4610, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.157.183.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T06:58:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:58:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.69.214.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T06:58:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:19:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7751, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.73", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T06:58:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:44:04Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19823, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "188.250.172.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:22:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:01:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68375, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.0.40.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:26:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:41:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20563, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.120.41.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:28:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:14:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65911, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.187.3.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:29:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:02:52Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 141" ], "sightings": 36224, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.214.100.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:29:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:39:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3939, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "50.192.223.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:31:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:42:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20551, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.73", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-09T07:32:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:53:57Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9425, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "69.135.10.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:38:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:39:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4566, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.196.220.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T07:43:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:53:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9038, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.245.139.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:50:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:01:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 18", "ET SCAN Potential SSH Scan" ], "sightings": 22250, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.95.115.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:56:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:07:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20403, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.231.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T08:05:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:20:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22605, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.255.127.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T08:06:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:22:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 20558, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.161.90.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T08:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:17:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18168, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.69.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T08:08:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22595, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.211.35.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T08:10:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:10:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4530, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.241.53.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T08:11:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:01:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 67488, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.112.42.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T08:12:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:25:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18060, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.29.205.168", "classifications": [], "first_seen": { "$date": "2023-03-09T08:34:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:34:29Z" }, "ports": [ 81 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 4502, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.129.88.14", "classifications": [], "first_seen": { "$date": "2023-03-09T08:46:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:46:24Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 4498, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.181.102.18", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:01:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:07:16Z" }, "ports": [ 22, 0, 1434 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 7678, "tags": [ "tcp", "ssh", "icmp", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "60.28.24.244", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:10:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:17:03Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13246, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.225.157.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T09:11:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:27:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is missing" ], "sightings": 35821, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.79.146.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:16:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:02:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8902, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.114.43.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:18:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:19:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.14.209.252", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:18:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:23:06Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11201, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:29:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:16:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.224.125.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:38:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11178, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.245.20", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-09T09:48:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:06:05Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 5784, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.110", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-09T09:49:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:09:55Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 7107, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.175.81.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:40:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7656, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.228.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:32:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7042, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.166.5.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T09:54:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:54:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4470, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.146.37.154", "classifications": [], "first_seen": { "$date": "2023-03-09T10:01:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:01:08Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2235, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.110.229.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T10:06:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:22:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 24039, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.48.83.86", "classifications": [], "first_seen": { "$date": "2023-03-09T10:06:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:40:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 10608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "178.72.101.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T10:26:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:27:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4464, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.52.13.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:29:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:29:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4462, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.162.48.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:30:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:30:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11148, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.135.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:31:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:31:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4456, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:40:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:47:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5518, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.1.131.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:40:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:40:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4445, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.117.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:41:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:02:14Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 11103, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:43:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:30:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8241, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.178.168.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:52:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:55:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8873, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.237.221.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T10:56:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:56:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.160.150.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T11:03:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T11:04:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4434, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.225.74.130", "classifications": [], "first_seen": { "$date": "2023-03-09T11:12:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T11:12:36Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2216, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.70.180.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T12:47:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T04:39:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 20" ], "sightings": 22476, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.214.245.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T12:48:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T12:52:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 21" ], "sightings": 9223, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.22", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-09T12:50:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:53:58Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 5775, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "118.70.180.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T12:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:24:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22055, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.30.191.118", "classifications": [], "first_seen": { "$date": "2023-03-09T01:23:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:56:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 5140, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "122.117.193.130", "classifications": [], "first_seen": { "$date": "2023-03-09T01:26:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:26:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 174, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "51.222.32.196", "classifications": [], "first_seen": { "$date": "2023-03-09T01:41:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:44:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1653, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "89.248.163.245", "classifications": [], "first_seen": { "$date": "2023-03-09T01:47:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T01:47:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 87, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "41.216.47.138", "classifications": [], "first_seen": { "$date": "2023-03-09T02:11:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T02:13:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 5123, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "195.33.237.83", "classifications": [], "first_seen": { "$date": "2023-03-09T02:19:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:12:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 108", "ET SCAN Potential SSH Scan" ], "sightings": 4300, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "188.166.251.87", "classifications": [], "first_seen": { "$date": "2023-03-09T02:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:56:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 99", "ET SCAN Potential SSH Scan" ], "sightings": 4644, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "58.144.251.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T02:21:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:03:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1461, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.223.6.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T02:22:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:21:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 143", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14324, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.2.17", "classifications": [], "first_seen": { "$date": "2023-03-09T02:23:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T03:14:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1806, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "171.49.151.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T03:39:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:18:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 58013, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.44.163.214", "classifications": [], "first_seen": { "$date": "2023-03-09T04:08:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:08:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 191, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "210.19.254.6", "classifications": [], "first_seen": { "$date": "2023-03-09T04:15:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T04:15:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 126" ], "sightings": 86, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.246.249.21", "classifications": [], "first_seen": { "$date": "2023-03-09T04:58:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:12:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 602, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.227.41.60", "classifications": [], "first_seen": { "$date": "2023-03-09T05:01:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:55:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1892, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "117.241.173.176", "classifications": [], "first_seen": { "$date": "2023-03-09T05:03:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T05:03:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 19" ], "sightings": 86, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.142.146.35", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-03-09T05:41:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:25:41Z" }, "ports": [ 80, 53, 0 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7065, "tags": [ "alert", "tcp", "http", "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "81.70.169.191", "classifications": [], "first_seen": { "$date": "2023-03-09T05:43:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:00:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 11524, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "183.136.170.173", "classifications": [], "first_seen": { "$date": "2023-03-09T06:03:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:03:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 95, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.205.5.193", "classifications": [], "first_seen": { "$date": "2023-03-09T06:25:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T06:25:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 86, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "96.69.13.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T06:40:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:57:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8906, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.61.69", "classifications": [], "first_seen": { "$date": "2023-03-09T06:40:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:35:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1892, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "20.255.60.194", "classifications": [], "first_seen": { "$date": "2023-03-09T07:29:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T07:45:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 860, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "72.167.52.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T07:30:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:03:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57533, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.71.46.226", "classifications": [], "first_seen": { "$date": "2023-03-09T07:30:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:29:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 33" ], "sightings": 3182, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "115.133.251.15", "classifications": [], "first_seen": { "$date": "2023-03-09T07:57:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:52:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2694, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.224", "classifications": [], "first_seen": { "$date": "2023-03-09T08:34:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:34:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 172, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "67.205.174.220", "classifications": [], "first_seen": { "$date": "2023-03-09T08:38:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:38:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174", "ET SCAN Potential SSH Scan" ], "sightings": 230, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "115.241.167.73", "classifications": [], "first_seen": { "$date": "2023-03-09T08:39:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:44:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2150, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "51.75.160.226", "classifications": [], "first_seen": { "$date": "2023-03-09T08:40:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:28:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 165", "ET SCAN Potential SSH Scan" ], "sightings": 4360, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "68.183.142.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T08:53:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:59:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174", "SURICATA STREAM CLOSEWAIT FIN out of window", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14743, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "223.113.121.94", "classifications": [], "first_seen": { "$date": "2023-03-09T08:54:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:09:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 257, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.23.198.159", "classifications": [], "first_seen": { "$date": "2023-03-09T08:54:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T08:54:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 2" ], "sightings": 86, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "177.10.201.57", "classifications": [], "first_seen": { "$date": "2023-03-09T08:55:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:55:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 82" ], "sightings": 3139, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.170.149.29", "classifications": [], "first_seen": { "$date": "2023-03-09T09:39:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:15:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET SCAN Potential SSH Scan" ], "sightings": 2579, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "24.199.94.27", "classifications": [], "first_seen": { "$date": "2023-03-09T09:41:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T10:28:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 135", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET SCAN Potential SSH Scan" ], "sightings": 4496, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "206.189.146.142", "classifications": [], "first_seen": { "$date": "2023-03-09T09:42:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:42:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 85, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "222.186.21.35", "classifications": [], "first_seen": { "$date": "2023-03-09T09:42:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T09:47:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA TCPv4 invalid checksum" ], "sightings": 5404, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "61.102.42.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T09:43:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:25:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 170", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19866, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.115.50.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T09:45:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:59:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2137, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.43.15.80", "classifications": [], "first_seen": { "$date": "2023-03-09T11:00:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T11:00:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127" ], "sightings": 197, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.144.136.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T11:01:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:26:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 255, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.168.95.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T12:57:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:23:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 20", "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2772, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "111.67.193.239", "classifications": [], "first_seen": { "$date": "2023-03-09T13:05:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:10:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 6283, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "14.99.114.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T13:11:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:11:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4410, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.215.148.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T13:17:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:17:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4398, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.163.127.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T13:23:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:24:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9154, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2600:9000:24f3:fc00:0000:df71:8000:93a1", "classifications": [], "first_seen": { "$date": "2023-03-09T13:11:44Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-03-09T13:11:44Z" }, "ports": [ 47318 ], "reporting_nodes": 1, "rules": [], "sightings": 82, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.45.71.86", "classifications": [], "first_seen": { "$date": "2023-03-09T13:15:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:16:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 492, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "110.141.212.12", "classifications": [], "first_seen": { "$date": "2023-03-09T13:21:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:28:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 15" ], "sightings": 492, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "81.91.156.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T13:22:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:33:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4011, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.195.91.241", "classifications": [], "first_seen": { "$date": "2023-03-09T13:22:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:15:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 163", "ET SCAN Potential SSH Scan" ], "sightings": 4513, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.101.23.51", "classifications": [], "first_seen": { "$date": "2023-03-09T13:23:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:23:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 160" ], "sightings": 82, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.218.94.98", "classifications": [], "first_seen": { "$date": "2023-03-09T13:25:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:25:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 185" ], "sightings": 82, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "58.186.85.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T13:26:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:31:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 169", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 114, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.89.127.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T13:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T13:51:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4386, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T13:51:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:05:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5444, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.143.122", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-09T14:12:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:12:34Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6576, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.175.28.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T14:15:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T13:03:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8643, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.71.152.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T14:15:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:32:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24672, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "131.0.32.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T14:18:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:18:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4382, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.198.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T14:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:11:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65399, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.36.111.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T14:21:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:33:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13115, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.44.194.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T14:23:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:24:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4380, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.9.221.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T14:36:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:36:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4365, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.209.114.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T14:41:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:47:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8565, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.50.47.6", "classifications": [], "first_seen": { "$date": "2023-03-09T14:49:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T14:49:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 78, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.23.149.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T14:58:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:13:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19566, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.114.140.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:01:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:53:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66691, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.255.165.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:02:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:13:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17387, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.42.176.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:04:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:24:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21691, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.252.161.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T15:09:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:09:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4347, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.190.37.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T15:10:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:10:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4347, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.79.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:10:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:10:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4343, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.104.225.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:14:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:40:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum" ], "sightings": 64727, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.50.173.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:15:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:32:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25929, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "81.192.46.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:32:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:09:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 180", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6515, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.143.177.14", "classifications": [], "first_seen": { "$date": "2023-03-09T15:34:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:55:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 913, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.232.158.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:01:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35124, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.22.102.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:18:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:29:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19015, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.68.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T15:25:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:41:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12170, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.77.202.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T15:37:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:37:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4310, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.81.127", "classifications": [], "first_seen": { "$date": "2023-03-09T15:37:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:37:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34" ], "sightings": 76, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "27.79.157.238", "classifications": [], "first_seen": { "$date": "2023-03-09T15:54:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:17:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA STREAM TIMEWAIT ACK with wrong seq", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 14685, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 7, "classification_count": 0 }, { "ioc": "112.111.0.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:51:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:08:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum" ], "sightings": 2165, "tags": [ "tcp", "ssh", "libssh-0.6.3", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.112.120.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:51:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T15:52:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4302, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.182.188.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:53:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:07:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23871, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.55.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T15:54:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:24:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25813, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.2.186.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T16:03:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:03:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4296, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T16:06:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:06:07Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4341, "tags": [ "icmp", "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "111.243.127.27", "classifications": [], "first_seen": { "$date": "2023-03-09T16:24:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:25:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 148, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "164.92.66.111", "classifications": [], "first_seen": { "$date": "2023-03-09T16:38:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:42:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2885, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "113.98.98.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T16:24:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:24:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T16:27:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:27:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.97.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T16:37:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:53:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21386, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.70.145.205", "classifications": [], "first_seen": { "$date": "2023-03-09T16:45:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:00:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 6205, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "113.125.126.230", "classifications": [], "first_seen": { "$date": "2023-03-09T16:50:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:52:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 5110, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "118.45.205.44", "classifications": [], "first_seen": { "$date": "2023-03-09T16:57:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:57:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 20" ], "sightings": 73, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.146.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T16:45:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:12:25Z" }, "ports": [ 162, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3788, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.236.62.188", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-09T16:50:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:50:59Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6405, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "13.38.118.106", "classifications": [], "first_seen": { "$date": "2023-03-09T16:51:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:51:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 2135, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "117.223.205.71", "classifications": [], "first_seen": { "$date": "2023-03-09T16:57:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T16:57:17Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 4268, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "231.76.213.234", "classifications": [], "first_seen": { "$date": "2023-03-09T17:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:03:01Z" }, "ports": [ 27251 ], "reporting_nodes": 1, "rules": [ "(decode) loopback IP", "(ipv4) IPv4 packet from multicast source address" ], "sightings": 4264, "tags": [ "udp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "39.104.89.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T17:03:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:03:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 4262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.155.236.172", "classifications": [], "first_seen": { "$date": "2023-03-09T17:36:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:41:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 4752, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "209.141.43.147", "classifications": [], "first_seen": { "$date": "2023-03-09T17:44:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:29:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1418, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.180.49.108", "classifications": [], "first_seen": { "$date": "2023-03-09T17:15:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:15:19Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2129, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.144.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T17:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:18:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4258, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.34.100.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T17:18:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:56:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 61354, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.95.40.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T17:39:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:39:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.125.94.71", "classifications": [], "first_seen": { "$date": "2023-03-09T17:46:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:27:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 117" ], "sightings": 78, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "74.201.28.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T17:49:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:15:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31998, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.236.70.252", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-09T17:55:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T17:55:57Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6363, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "193.42.32.202", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-09T18:03:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:47:35Z" }, "ports": [ 161, 0, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 83885, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "97.90.33.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T18:06:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:23:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8462, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.152.57.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T18:06:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:06:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8471, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.195.46", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T18:08:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:08:47Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6354, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.214.8", "classifications": [ "Attempted Information Leak", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-09T18:09:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:23:54Z" }, "ports": [ 161, 0, 111 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 7550, "tags": [ "udp", "snmp", "icmp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "107.170.229.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T18:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:59:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5875, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.139.70.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T18:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:18:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4226, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.243.43.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T18:23:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:23:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 4224, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.194.57", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-09T18:30:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T00:36:22Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 5537, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.88.165.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T18:38:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:38:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4214, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.152.3.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T18:44:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:45:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4202, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.206.36.97", "classifications": [], "first_seen": { "$date": "2023-03-09T18:58:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:59:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 136, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "205.185.123.242", "classifications": [], "first_seen": { "$date": "2023-03-09T19:14:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:14:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 121" ], "sightings": 68, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.68.95.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T18:47:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T18:47:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4200, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.228.152.176", "classifications": [], "first_seen": { "$date": "2023-03-09T19:18:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:54:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 131", "ET SCAN Potential SSH Scan" ], "sightings": 3432, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "152.32.139.77", "classifications": [], "first_seen": { "$date": "2023-03-09T19:18:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:28:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 270, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "89.17.201.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T18:55:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:55:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4344, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.143.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T18:56:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:10:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25136, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.131.128.21", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T18:58:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:00:20Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14976, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.231.105.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:07:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:07:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8375, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.7.45.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T19:13:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:15:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4182, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:21:49Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:15:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5887, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.29.178.191", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:21:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8359, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.255.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:25:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:25:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4178, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.88.123.168", "classifications": [], "first_seen": { "$date": "2023-03-09T19:44:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:54:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1289, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "85.247.2.222", "classifications": [], "first_seen": { "$date": "2023-03-09T19:44:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:56:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1390, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.96.140.1", "classifications": [], "first_seen": { "$date": "2023-03-09T19:30:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:06:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 8318, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "87.236.176.145", "classifications": [], "first_seen": { "$date": "2023-03-09T19:31:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:31:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 2086, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.87.88.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:37:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:43:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6155, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.99.96.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:38:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:38:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4168, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.140", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-09T19:38:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:25:59Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 13997, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.241.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:40:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:57:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4184, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.106.35.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:41:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:49:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 228084, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.169.9.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T19:42:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:49:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21648, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.198.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:44:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:37:26Z" }, "ports": [ 0, 22 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 4927, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.68.78.92", "classifications": [], "first_seen": { "$date": "2023-03-09T19:44:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:52:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 8327, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "202.157.189.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T19:45:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:55:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 18714, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:46:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4162, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.170.2.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T19:49:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:49:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4160, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.231.83", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:52:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:07:07Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28144, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.239.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:54:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:25:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6870, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.218.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T19:55:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T19:55:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4155, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.251.143.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T19:55:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:36:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4158, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.122.17.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T19:57:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:10:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20712, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.155.139.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T20:00:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:37:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1942, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.13.43.113", "classifications": [], "first_seen": { "$date": "2023-03-09T20:05:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:05:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 64, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "172.104.242.173", "classifications": [], "first_seen": { "$date": "2023-03-09T20:07:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:07:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 256, "tags": [ "alert", "tcp", "ssh", "anomaly" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "161.115.86.188", "classifications": [], "first_seen": { "$date": "2023-03-09T20:27:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:29:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2906, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "24.237.189.206", "classifications": [], "first_seen": { "$date": "2023-03-09T20:10:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:10:50Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 4136, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "36.235.107.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T20:13:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:13:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4136, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.146.38.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T20:22:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:47:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 61093, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.237.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T20:23:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:56:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9153, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T20:27:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:02:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4133, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.126.207.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T20:27:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:27:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4123, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.212.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T20:28:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:07:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 175", "ET SCAN Potential SSH Scan" ], "sightings": 31504, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.168.63", "classifications": [], "first_seen": { "$date": "2023-03-09T20:49:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:49:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 13" ], "sightings": 62, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.56.61.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T20:33:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:18:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16839, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.192.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T20:36:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T19:21:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6806, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.81.22.70", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-03-09T20:41:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:09:18Z" }, "ports": [ 0, 1434, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 65421, "tags": [ "icmp", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "83.244.14.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T20:46:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:05:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5654, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.26.183.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T20:48:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T20:48:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4106, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.226.108.174", "classifications": [], "first_seen": { "$date": "2023-03-09T21:05:32Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T15:50:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 32" ], "sightings": 73, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "117.83.111.56", "classifications": [], "first_seen": { "$date": "2023-03-09T21:13:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:16:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 3477, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "190.145.12.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:32:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:30:19Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5873, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "15.235.141.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:02:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:51:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60527, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.112.128.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:02:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:12:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16342, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.157.23.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:03:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24439, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.164.12.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T21:04:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:04:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4097, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.217.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T21:05:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:05:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4091, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.173.122.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:06:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:50:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60485, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.46.135.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:06:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:21:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18309, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.91.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:07:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:03:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62413, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "84.252.143.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:07:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:07:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2045, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.47.206.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:08:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:48:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60504, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "135.125.188.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T21:08:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:08:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4083, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.70.1.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:09:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:47:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 107" ], "sightings": 60590, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.148.120.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:10:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:44:58Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 156", "ET 3CORESec Poor Reputation IP group 36" ], "sightings": 33625, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "5.200.58.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:11:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:38:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14313, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.159.200.1", "classifications": [], "first_seen": { "$date": "2023-03-09T21:15:19Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:46:20Z" }, "ports": [ 33966, 49373, 41758, 57727, 46598, 60635, 45471, 34395, 54864, 45484, 59387, 51470, 52720 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 7328, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.232.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T21:15:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:15:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4068, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.19.156.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:15:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:15:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2034, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.172.178.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:23:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:57:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60095, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.161.244.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T21:23:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:27:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38552, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.235.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T21:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:51:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4029, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.195.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T21:49:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:49:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.247.224.45", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-09T21:53:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:19:18Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11947, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.107.95.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T21:59:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:59:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3980, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.211.229.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T22:12:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:13:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3978, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.52.9.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T22:14:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:01:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 59465, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.40.9.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T22:38:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:01:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19792, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.223.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T22:43:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:32:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16168, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.42.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T22:43:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:58:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17813, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "42.119.5.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T22:44:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:44:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3964, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.63.40.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T22:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:46:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3961, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.44.41.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T22:59:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:59:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3954, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.106.103.46", "classifications": [], "first_seen": { "$date": "2023-03-09T23:02:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:43:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 7798, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "107.170.233.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T23:04:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:57:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4902, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.132.207.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T23:12:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:22:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15698, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.134.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T23:16:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:16:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3946, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.207.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T23:19:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:19:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3946, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.92.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T23:21:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:38:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4553, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.238.10", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-09T23:25:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:07:05Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 8834, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "121.141.32.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T23:27:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:28:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3940, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.249.248.143", "classifications": [], "first_seen": { "$date": "2023-03-09T23:31:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:31:38Z" }, "ports": [ 81 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 3940, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.36.69.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T23:32:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:19:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4248, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.24.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T23:34:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:52:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21623, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.145.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T23:37:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:37:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1969, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.230.253.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T23:37:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:43:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7868, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.210.228.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T23:37:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:21:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21574, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.57.168.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T23:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:43:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3932, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.57.140.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T23:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:43:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3932, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.229.167.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-09T23:56:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:56:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3922, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.90.157.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-09T23:58:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:51:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4806, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.214.202.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T00:03:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:17:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7833, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.32.85.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T00:08:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:08:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3917, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.95.177.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T00:11:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:13:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3914, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.47.17.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T00:13:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:56:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 4989, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.155.96.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T00:24:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:21:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15685, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.195.51", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-10T00:28:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:29:27Z" }, "ports": [ 0, 111, 1434 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "SQL ping attempt" ], "sightings": 3924, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.12.253.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T00:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:01:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11356, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.97.93.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T00:34:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:34:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1953, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T00:39:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:07:32Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 5192, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "115.223.23.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T00:49:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:01:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6284, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.56.61.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T00:55:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:23:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19952, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T00:56:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:15:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5312, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.91.127.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T01:24:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T01:32:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.60.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T01:24:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:02:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10470, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.82", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-10T01:44:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:47:22Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10911, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.157.232.100", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T01:58:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:17:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 28316, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "112.6.130.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T02:08:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:08:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 9700, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "24.52.35.26", "classifications": [], "first_seen": { "$date": "2023-03-10T02:15:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:15:08Z" }, "ports": [ 8080 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 3877, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "1.25.193.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T02:20:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:20:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3876, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.218.165.102", "classifications": [], "first_seen": { "$date": "2023-03-10T02:24:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:24:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "(stream_tcp) reset outside window" ], "sightings": 3874, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "202.77.101.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T02:27:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:39:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8277, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.229.192.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T02:27:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:28:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3872, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.226.207.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T02:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:21:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36445, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "85.117.240.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T02:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:36:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3868, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.239.111.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T02:41:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:25:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4851, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T02:44:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:41:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.59.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T02:46:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:03:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 19435, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.17.94.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T02:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:56:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1931, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.230.113.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T03:21:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:46:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24309, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.165.121.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T03:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:36:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3854, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.177.59.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T03:39:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:39:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3852, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.76.200.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T03:41:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:56:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7697, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T03:53:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:50:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5918, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.237.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T04:02:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:43:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2667, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.117.36.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T04:08:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:09:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3844, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.167.104.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T04:10:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:20:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68278, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T04:14:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:14:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3844, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.24.187.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T04:22:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:33:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15337, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.109.180.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T04:27:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:44:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 49707, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.224.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T04:34:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:21:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45666, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.119.92.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T04:36:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:21:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9813, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.27.7.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T04:38:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T12:36:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29061, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.41.241.33", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T04:40:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:35:20Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 33680, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "120.29.86.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T04:50:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:50:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3816, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.176.222.130", "classifications": [], "first_seen": { "$date": "2023-03-10T04:51:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:51:49Z" }, "ports": [ 81 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 3816, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.197.218.185", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T04:59:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:59:42Z" }, "ports": [ 135, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 5705, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.222", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-10T05:02:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:00:41Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 6805, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "20.115.37.25", "classifications": [], "first_seen": { "$date": "2023-03-10T05:11:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:11:31Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1900, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "190.9.130.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T05:24:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T17:40:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22801, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.59.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T05:25:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:30:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28400, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.56.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T05:26:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:43:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22710, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.230.91.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T05:26:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:13:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27686, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.172.158.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T05:28:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:39:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17045, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "144.126.140.214", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-03-10T05:28:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:29:14Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17366, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.37.124.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T05:38:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:02:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30051, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.133.198.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T05:45:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:45:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3772, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T05:48:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:43:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6278, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.87.248", "classifications": [], "first_seen": { "$date": "2023-03-10T05:55:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:55:50Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1886, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "98.47.168.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T05:58:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:43:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56354, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.59.110.1", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T06:15:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:53:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5638, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.177.182.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T06:24:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:33:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7494, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.232.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T06:25:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:45:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3761, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.119", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-10T06:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:17:37Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 8668, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.136.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T06:56:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:56:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3750, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.138.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T07:04:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:04:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.240.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T07:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:06:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.173.251.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T07:10:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:00:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33592, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.253.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T07:13:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:38:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4920, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.221.17.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T07:14:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:24:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11228, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.117.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T07:16:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:16:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3744, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.109.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T07:21:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:56:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77579, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.25.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T07:24:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:35:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18686, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.98.59.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T07:26:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:42:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10714, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.156.155.7", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T07:39:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:00:04Z" }, "ports": [ 3352, 161, 56019 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 5522, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.44", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-10T08:21:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:45:10Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5603, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.139.70", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-10T08:41:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:19:06Z" }, "ports": [ 0, 80, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) reset outside window", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 4229, "tags": [ "icmp", "tcp", "http", "udp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "197.5.145.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T08:52:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:25:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5968, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.49.37.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T08:52:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:52:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1852, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.205.19.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T08:52:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:50:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15090, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.117.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T08:54:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:54:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1852, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "40.114.242.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T15:46:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:00:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) SYN on established session", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60976, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.83.16.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T15:48:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:40:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 119" ], "sightings": 29023, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.192.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T15:49:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:02:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20303, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.24.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T15:49:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:03:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22148, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "18.60.88.49", "classifications": [], "first_seen": { "$date": "2023-03-09T21:45:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T21:50:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 480, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "3.9.74.216", "classifications": [], "first_seen": { "$date": "2023-03-09T22:11:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:12:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 4380, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "34.207.184.169", "classifications": [], "first_seen": { "$date": "2023-03-09T22:15:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:17:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 4380, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "60.248.221.78", "classifications": [], "first_seen": { "$date": "2023-03-09T22:38:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:38:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 60" ], "sightings": 120, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "52.198.123.73", "classifications": [], "first_seen": { "$date": "2023-03-09T22:48:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:58:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1080, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "77.182.182.191", "classifications": [], "first_seen": { "$date": "2023-03-09T22:52:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:35:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1800, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "4.246.208.224", "classifications": [], "first_seen": { "$date": "2023-03-09T22:53:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:53:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 144" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.148.7.52", "classifications": [], "first_seen": { "$date": "2023-03-09T22:55:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:55:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 180, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.126.11.125", "classifications": [], "first_seen": { "$date": "2023-03-09T22:55:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T22:57:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 420, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "154.92.22.5", "classifications": [], "first_seen": { "$date": "2023-03-09T23:02:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:06:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 4560, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "34.81.65.106", "classifications": [], "first_seen": { "$date": "2023-03-09T23:43:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:43:38Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 20" ], "sightings": 60, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.226.103.102", "classifications": [], "first_seen": { "$date": "2023-03-09T23:55:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-09T23:59:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 186" ], "sightings": 240, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.68.87.108", "classifications": [], "first_seen": { "$date": "2023-03-09T23:59:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:16:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 537, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "112.64.32.118", "classifications": [], "first_seen": { "$date": "2023-03-10T00:02:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:19:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 179, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "70.37.75.157", "classifications": [], "first_seen": { "$date": "2023-03-10T00:02:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T01:00:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 176", "ET SCAN Potential SSH Scan" ], "sightings": 2721, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "159.65.235.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T00:02:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:52:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 61", "ET 3CORESec Poor Reputation IP group 16", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4430, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "38.47.76.28", "classifications": [], "first_seen": { "$date": "2023-03-10T00:02:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:27:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 119, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "164.90.189.102", "classifications": [], "first_seen": { "$date": "2023-03-10T00:04:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:04:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 67" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "20.205.97.129", "classifications": [], "first_seen": { "$date": "2023-03-10T00:06:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:55:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1773, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "147.135.219.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T00:06:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:29:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 49", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14305, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.6.238", "classifications": [], "first_seen": { "$date": "2023-03-10T00:06:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:58:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1301, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.254.76.56", "classifications": [], "first_seen": { "$date": "2023-03-10T00:34:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T00:35:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 295, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.116.49.120", "classifications": [], "first_seen": { "$date": "2023-03-10T01:24:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T01:27:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 8", "ET SCAN Potential SSH Scan" ], "sightings": 472, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "171.233.78.211", "classifications": [], "first_seen": { "$date": "2023-03-10T01:41:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T01:42:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 354, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "78.31.71.27", "classifications": [], "first_seen": { "$date": "2023-03-10T01:56:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:00:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 3953, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "175.196.121.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T02:02:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:36:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET 3CORESec Poor Reputation IP group 19", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1422, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "68.183.170.149", "classifications": [], "first_seen": { "$date": "2023-03-10T02:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T02:46:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 175" ], "sightings": 59, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.156.18.253", "classifications": [], "first_seen": { "$date": "2023-03-10T03:01:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:56:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 152", "ET SCAN Potential SSH Scan" ], "sightings": 3068, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.212.248.86", "classifications": [], "first_seen": { "$date": "2023-03-10T03:04:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T03:52:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1770, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "203.162.19.237", "classifications": [], "first_seen": { "$date": "2023-03-10T03:05:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:00:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1121, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.253.10.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T03:05:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:10:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127", "ET 3CORESec Poor Reputation IP group 28", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 144914, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "91.240.118.75", "classifications": [], "first_seen": { "$date": "2023-03-10T04:48:40Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T02:25:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 87" ], "sightings": 123, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.209.62.109", "classifications": [], "first_seen": { "$date": "2023-03-10T04:57:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:44:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1770, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "161.35.236.24", "classifications": [], "first_seen": { "$date": "2023-03-10T04:58:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T04:58:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 64" ], "sightings": 59, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.179.150.231", "classifications": [], "first_seen": { "$date": "2023-03-10T04:59:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:55:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 8" ], "sightings": 97, "tags": [ "alert", "tcp", "ssh", "HELLOWORLD" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.255.141.251", "classifications": [], "first_seen": { "$date": "2023-03-10T05:01:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:39:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 46", "ET SCAN Potential SSH Scan" ], "sightings": 431, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.68.94.192", "classifications": [], "first_seen": { "$date": "2023-03-10T05:02:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:02:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 165" ], "sightings": 59, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "123.63.70.105", "classifications": [], "first_seen": { "$date": "2023-03-10T05:12:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:12:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 23", "ET 3CORESec Poor Reputation IP group 9" ], "sightings": 118, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "23.251.102.78", "classifications": [], "first_seen": { "$date": "2023-03-10T05:22:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:22:51Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 12" ], "sightings": 59, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.146.183.60", "classifications": [], "first_seen": { "$date": "2023-03-10T05:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T05:36:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 59, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "93.190.105.61", "classifications": [], "first_seen": { "$date": "2023-03-10T06:12:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:13:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 88" ], "sightings": 236, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.244.73.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T06:49:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:18:54Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "ET 3CORESec Poor Reputation IP group 3", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13456, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "206.189.233.163", "classifications": [], "first_seen": { "$date": "2023-03-10T06:49:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:54:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 122", "ET SCAN Potential SSH Scan" ], "sightings": 2845, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "206.81.14.65", "classifications": [], "first_seen": { "$date": "2023-03-10T06:49:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:36:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 123", "ET SCAN Potential SSH Scan" ], "sightings": 2887, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "54.37.71.177", "classifications": [], "first_seen": { "$date": "2023-03-10T06:49:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T06:54:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2773, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "165.227.87.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T06:52:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:18:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 72", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2921, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.239.29.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T07:12:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:17:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2553, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.51.249.235", "classifications": [], "first_seen": { "$date": "2023-03-10T07:44:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:14:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1044, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.37.149.4", "classifications": [], "first_seen": { "$date": "2023-03-10T07:45:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T08:54:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127" ], "sightings": 2146, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "81.192.87.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T07:45:26Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:02:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 180", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16421, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.213.100.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T07:46:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:43:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 28", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8032, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "87.236.176.155", "classifications": [], "first_seen": { "$date": "2023-03-10T07:52:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:56:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 174, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.35.165.175", "classifications": [], "first_seen": { "$date": "2023-03-10T07:56:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T07:56:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 174, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "212.227.6.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-10T08:14:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:43:15Z" }, "ports": [ 22, 0 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12346, "tags": [ "ssh", "tcp", "ssh", "ssh", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "174.21.82.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T16:03:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:03:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3682, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T16:10:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:22:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10066, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.116.138", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T16:15:14Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:05:30Z" }, "ports": [ 5060, 0, 53 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 9146, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.105.127", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T16:16:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:47:09Z" }, "ports": [ 5060, 0, 161, 1434 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 10407, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "27.124.32.190", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T16:17:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:17:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3665, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.214.243.101", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-03-10T16:18:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:12:08Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 14659, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "152.238.109.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T16:18:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:19:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3664, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.209.112", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-10T16:21:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:03:31Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 6309, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "194.37.82.60", "classifications": [], "first_seen": { "$date": "2023-03-10T16:32:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:47:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 221, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "130.162.156.31", "classifications": [], "first_seen": { "$date": "2023-03-10T16:32:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:32:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 29" ], "sightings": 56, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.110.241.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T16:33:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:19:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 44", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 606, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.21.34.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T16:34:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:52:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8569, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.92.69.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T16:35:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:41:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1149, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "196.192.179.35", "classifications": [], "first_seen": { "$date": "2023-03-10T16:35:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:43:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 109", "ET SCAN Potential SSH Scan" ], "sightings": 3405, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "80.80.218.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T16:35:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:21:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 180", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30650, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "206.189.213.126", "classifications": [], "first_seen": { "$date": "2023-03-10T16:35:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:35:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 122", "ET 3CORESec Poor Reputation IP group 27" ], "sightings": 112, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "198.199.98.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T16:31:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:38:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5455, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.92.70.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T16:36:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:36:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3658, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.131.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T16:37:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:37:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3658, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.195.170.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T16:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:39:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3655, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.243.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T16:51:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T16:51:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3652, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.169.241.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T16:54:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:57:30Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "106.111.29.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T17:09:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:09:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 9120, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "124.220.12.226", "classifications": [], "first_seen": { "$date": "2023-03-10T17:14:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:18:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 3869, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "121.188.122.210", "classifications": [], "first_seen": { "$date": "2023-03-10T17:20:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:50:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 66, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "91.74.45.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T17:29:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:29:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3646, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.225", "classifications": [], "first_seen": { "$date": "2023-03-10T17:38:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T22:46:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 106, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "149.18.73.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T17:31:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:27:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7242, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.189.7.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T17:33:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:33:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7288, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.148.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T17:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:34:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6393, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.95.12.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T17:39:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:39:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3644, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.167.97.191", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T17:43:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:43:30Z" }, "ports": [ 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp" ], "sightings": 1822, "tags": [ "tcp", "snmptrap" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "108.241.15.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T17:43:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:44:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3644, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.193.104", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-10T17:53:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T17:53:16Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5457, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "113.161.53.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T17:56:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:24:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 67425, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.153.32.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T17:56:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:16:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10885, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.92.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T17:58:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:17:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3638, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.223.197.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T17:58:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:12:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16323, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.229.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T17:59:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:09:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14508, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "158.160.49.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T18:01:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:09:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12694, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.159.153.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T18:02:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:15:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12687, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.174.21.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T18:06:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:06:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3626, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.40.181.24", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-10T18:09:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:42:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 65448, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.192.41.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T18:11:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:12:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3626, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.109.192.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T18:26:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:27:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream after TCP reset sent" ], "sightings": 9042, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.58.180.203", "classifications": [], "first_seen": { "$date": "2023-03-10T18:35:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:40:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2063, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "205.210.31.17", "classifications": [ "Misc activity", "Attempted Information Leak", "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T18:30:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:49:56Z" }, "ports": [ 0, 80, 53, 22 ], "reporting_nodes": 3, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7083, "tags": [ "icmp", "alert", "tcp", "http", "udp", "ssh" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "186.26.87.1", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T18:31:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:31:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3612, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.33.1.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T18:44:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:44:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3610, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.154.58.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T18:46:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T18:46:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.80.249.239", "classifications": [], "first_seen": { "$date": "2023-03-10T19:04:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:31:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 5711, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "211.157.164.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T19:11:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:11:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 9000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "24.63.100.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T19:14:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:14:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3600, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.26.84.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T19:15:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:15:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.155.36.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T19:18:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:19:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream after TCP reset sent" ], "sightings": 7196, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.235.24.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T19:22:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:34:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4578, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.95.36", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-10T19:32:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:32:22Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7188, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "41.73.252.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T19:34:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:46:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12566, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.161.111.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T19:37:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:38:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3592, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.171.165.16", "classifications": [], "first_seen": { "$date": "2023-03-10T19:56:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T19:56:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 42, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.232.141.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T20:01:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:24:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28484, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.176.78.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T20:03:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:15:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12493, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.210.243.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T20:03:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:54:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11084, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.44.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T20:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:51:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10729, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.245.33.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T20:06:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:18:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16118, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.253.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T20:07:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:20:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12461, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "150.109.149.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T20:08:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:15:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10699, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.189.30.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T20:16:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:54:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24870, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.102.154.183", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-10T20:16:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:16:32Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5331, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "123.156.226.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T20:28:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:59:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10675, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.169.201.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T20:29:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:41:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 15928, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.105.106", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T20:38:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:38:44Z" }, "ports": [ 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp" ], "sightings": 1770, "tags": [ "tcp", "snmptrap" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.184.71.175", "classifications": [], "first_seen": { "$date": "2023-03-10T20:56:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:51:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157" ], "sightings": 2397, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.206.11", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-10T20:51:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:00:30Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10166, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "153.92.220.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T20:52:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:57:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5418, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.150.211.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T20:53:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:53:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.44.238.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T20:56:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:42:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42220, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.85.144.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T20:58:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T20:58:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:01:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:36:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27266, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.145.13.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:03:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:03:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3529, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.131.101.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:03:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:03:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3529, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "81.16.8.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:15:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:15:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3527, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.208.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:55:43Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 6861, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.227.32.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:30:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:58:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31144, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.48.116.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:30:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:20:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20924, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.19.27.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:32:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:43:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15846, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.1.222.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:36:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3521, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.117.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:43:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:09:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4556, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.209.160.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:01:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17511, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.230.31.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:46:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:43:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15056, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.217.131.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:47:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:22:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15777, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.24.207.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:49:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:48:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.143.89.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:52:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:51:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20326, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.245.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:55:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:55:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3501, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.112.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T21:57:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:19:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3839, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.40.79.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T21:58:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:06:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 31321, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.223.89.224", "classifications": [], "first_seen": { "$date": "2023-03-10T21:43:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T21:58:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum" ], "sightings": 5304, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "222.146.129.38", "classifications": [], "first_seen": { "$date": "2023-03-10T22:02:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:02:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 117, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.241.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T22:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:05:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3486, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.249.189.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T22:14:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:14:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3486, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.204.26.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T22:24:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T12:58:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8134, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.98.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T22:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:31:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3483, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T22:33:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:05:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22833, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.93.43", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T22:48:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:00:49Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 7439, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.138.44.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T22:52:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T22:52:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3476, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.17.96.38", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T22:56:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:48:52Z" }, "ports": [ 56006, 8007, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 5140, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.186.13.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T23:00:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:24:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7905, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.88.208.172", "classifications": [], "first_seen": { "$date": "2023-03-10T23:12:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:12:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 1734, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.223.33.106", "classifications": [], "first_seen": { "$date": "2023-03-10T23:26:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:50:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA TCPv4 invalid checksum" ], "sightings": 8690, "tags": [ "ssh", "tcp", "ssh", "Go", "ssh", "alert", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "23.251.102.76", "classifications": [], "first_seen": { "$date": "2023-03-10T23:26:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:26:01Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 12" ], "sightings": 37, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.223.32", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-10T23:26:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:03:34Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 9142, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "112.2.60.117", "classifications": [], "first_seen": { "$date": "2023-03-10T23:30:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:30:26Z" }, "ports": [ 37215 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 3460, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "156.247.204.198", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-10T23:31:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:20:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 18507, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "191.252.179.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-10T23:34:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:49:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32574, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.17.16.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T23:40:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:20:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 216287, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.153.192.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T23:42:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-10T23:57:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18948, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.225.105.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-10T23:52:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:54:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 171", "ET 3CORESec Poor Reputation IP group 42", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8629, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "52.207.133.243", "classifications": [], "first_seen": { "$date": "2023-03-11T00:01:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T03:00:19Z" }, "ports": [ 56330, 35514 ], "reporting_nodes": 1, "rules": [ "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management" ], "sightings": 738, "tags": [ "alert", "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.2.221.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T00:03:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:46:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 14", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9845, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.92.229", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T00:00:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:42:27Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6883, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.206.10", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T00:00:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:00:38Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6878, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.224.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T00:18:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T02:39:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6812, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.118.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T00:25:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:35:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5199, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "166.88.144.159", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-11T00:26:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:56:14Z" }, "ports": [ 1434, 0, 1900, 161 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 389643, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "192.241.204.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T00:30:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:42:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3435, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.167.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T00:44:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:59:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 68" ], "sightings": 20529, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.34.152.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T00:56:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:56:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3417, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.238.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T00:56:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:27:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3786, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.186.204", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T00:59:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T00:59:09Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6830, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.132.53.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T01:12:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:12:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3407, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.217.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T01:12:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:12:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3407, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.238.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T01:14:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:14:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3408, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.92.209.36", "classifications": [], "first_seen": { "$date": "2023-03-11T01:41:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:42:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 192, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "31.43.185.3", "classifications": [], "first_seen": { "$date": "2023-03-11T01:15:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:15:30Z" }, "ports": [ 3394 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1703, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.94", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-11T01:19:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:18:35Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 3425, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.101.240.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T01:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:33:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10203, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.44.2.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T01:21:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:33:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13602, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.112.238.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T01:24:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6816, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.29", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-11T01:32:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:38:05Z" }, "ports": [ 0, 1434, 80, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "(stream_tcp) reset outside window", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 3434, "tags": [ "icmp", "udp", "tcp", "http" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "115.196.36.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T01:37:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:37:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3395, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.97.243.126", "classifications": [], "first_seen": { "$date": "2023-03-11T01:40:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:40:04Z" }, "ports": [ 88 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 3394, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.94.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T01:43:51Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:03:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6502, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.149.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T01:44:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T12:25:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5098, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.174.35.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T01:48:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:48:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3390, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.195.68.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T01:54:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T01:54:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3390, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.189.122.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T02:21:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:36:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.233.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T02:27:14Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T03:58:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T02:29:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:01:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T02:40:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T02:40:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.167.151.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T02:42:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T02:42:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T02:51:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:35:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3384, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.225.163.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T02:55:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:38:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.91.57.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T02:56:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T02:56:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.185.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T02:58:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:11:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68825, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.59.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T03:04:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:16:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16807, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.131.30.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T03:05:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:21:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18463, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.75.221.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T03:05:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:15:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 169", "ET SCAN Potential SSH Scan" ], "sightings": 12445, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "218.161.74.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T03:15:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:16:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3356, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.136.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T03:20:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:20:27Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5025, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.215.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T03:21:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:21:14Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5022, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "27.124.32.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T03:22:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:22:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3348, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.194.138.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T03:23:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:23:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3348, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.190.149.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T03:24:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:32:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5947, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.181.35.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T03:27:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:27:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3346, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T03:38:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:38:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3336, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.147.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T03:40:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:09:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3338, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.87.184.19", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-11T04:13:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T04:13:25Z" }, "ports": [ 3389, 162, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 4992, "tags": [ "tcp", "rdp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "65.49.20.84", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-11T04:30:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:38:19Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13346, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "74.93.12.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T04:33:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:12:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3924, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.133.115.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T04:52:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T04:53:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3321, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.87.216.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T05:05:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:22:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13247, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.94.0.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T05:06:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:20:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14906, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.239.106.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T05:08:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:00:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 28068, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.159.40.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T05:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:22:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14898, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.132.105.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T05:10:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:22:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13243, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.128.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T05:10:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:50:21Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4982, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.142.125.234", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T05:30:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:07:55Z" }, "ports": [ 177, 0 ], "reporting_nodes": 1, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14605, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.189.6.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T05:52:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:55:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9845, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.110.138.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:10:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:10:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6336, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.118.55.174", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:18:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:24:14Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8218, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "49.205.235.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:18:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:18:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3288, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.182.113.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.13.160.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.169.66.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.136.46.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.204.216.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.97.160.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.71.132.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6572, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.203.173.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T06:26:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:38:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6561, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.228.117.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T06:27:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:42:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13123, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "74.82.47.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:31:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:53:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5327, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.231.3.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:31:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:31:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3282, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.43.89.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T06:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:51:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 112", "ET SCAN Potential SSH Scan" ], "sightings": 21442, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "143.198.105.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:45:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:59:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15004, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.242.248.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T06:48:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:29:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8190, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "183.106.215.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T07:11:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:11:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3264, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T07:24:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:55:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12792, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.84.89.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T07:25:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:26:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3264, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T07:35:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:38:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5468, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.221.205.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T07:39:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:21:42Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) partial start line", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7450, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "118.161.120.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T07:47:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:48:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3264, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T07:55:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:54:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3272, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.124", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-11T07:57:33Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:35:52Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14599, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "64.62.197.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T08:01:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:01:39Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "ET DROP Dshield Block Listed Source group 1" ], "sightings": 3266, "tags": [ "icmp", "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "122.54.189.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T08:09:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:09:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.84.172.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T08:28:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:45:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13019, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "196.219.234.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T08:32:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:43:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13021, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.56.61.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T08:35:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:00:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3882, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.223.154.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T08:44:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:35:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14651, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "52.185.227.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T08:48:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:58:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 46927, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.214.27.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T08:55:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:55:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3248, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.151.125.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T08:57:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:57:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3248, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.46.13", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-03-11T08:58:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:30:27Z" }, "ports": [ 22, 0 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data sent on stream after TCP reset received", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3252, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "116.52.144.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T09:01:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T01:19:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum" ], "sightings": 1645, "tags": [ "tcp", "ssh", "alert", "libssh-0.6.3" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.132.16", "classifications": [], "first_seen": { "$date": "2023-03-11T09:03:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:03:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 1624, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.92.18.138", "classifications": [], "first_seen": { "$date": "2023-03-11T09:06:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:25:00Z" }, "ports": [ 50001, 4443, 8888, 6443, 8080, 7443, 993, 3389, 9000, 5001 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 5156, "tags": [ "tcp", "http", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "92.205.40.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T09:19:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:38:59Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 187", "ET 3CORESec Poor Reputation IP group 46" ], "sightings": 27689, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.208.7", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T09:20:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:20:42Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4868, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "116.193.191.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T09:21:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:37:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14566, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.243.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T09:24:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:38:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16179, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.132.137.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T09:27:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T10:23:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 61129, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.231.86.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T09:27:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:42:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6465, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.94.138.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T09:41:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:20:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4251, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T09:55:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:35:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7376, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.173.216.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T10:19:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T10:20:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3209, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "204.2.134.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T10:38:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:36:34Z" }, "ports": [ 0, 58330 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) UDP filtered portsweep" ], "sightings": 3512, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "87.236.176.243", "classifications": [], "first_seen": { "$date": "2023-03-11T10:42:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T10:42:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 1604, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.97.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:00:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:49:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39795, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.245.96.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:00:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:00:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3206, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:01:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:01:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3206, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.247.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:03:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:09:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4620, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.171.113.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:06:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3204, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.245.234.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T11:07:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T17:27:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23886, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.97.108.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T11:08:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:00:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25554, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.236.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T11:09:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:20:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9607, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.95.12.22", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:27:42Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7304, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "159.203.208.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:41:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:41:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3196, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.43.182.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:41:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:41:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3196, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.42.239.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T11:45:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:19:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3216, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.99.200.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T11:47:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:03:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14338, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "84.201.158.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T11:47:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:02:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 40059, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.34.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T11:47:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:59:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14344, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.199.138.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T12:15:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:20:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10040, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "168.80.174.2", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-11T12:17:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:23:40Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 21690, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.180.143.15", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T12:50:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:58:00Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7925, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.200.244.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T12:56:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:56:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3170, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.221.18.139", "classifications": [], "first_seen": { "$date": "2023-03-11T02:18:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T02:19:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA STREAM reassembly overlap with different data" ], "sightings": 155, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "183.108.122.61", "classifications": [], "first_seen": { "$date": "2023-03-11T02:38:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T02:38:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 21" ], "sightings": 62, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "18.178.112.44", "classifications": [], "first_seen": { "$date": "2023-03-11T02:38:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T02:41:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 124, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.17.63.85", "classifications": [], "first_seen": { "$date": "2023-03-11T03:17:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:17:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 185" ], "sightings": 31, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.250.37.227", "classifications": [], "first_seen": { "$date": "2023-03-11T03:35:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:36:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 62, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.156.108.211", "classifications": [], "first_seen": { "$date": "2023-03-11T03:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T03:54:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 1488, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "194.110.203.109", "classifications": [], "first_seen": { "$date": "2023-03-11T04:14:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T04:15:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 24", "ET SCAN Potential SSH Scan" ], "sightings": 62, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "111.242.20.227", "classifications": [], "first_seen": { "$date": "2023-03-11T04:16:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T04:17:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 186, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.203.239.185", "classifications": [], "first_seen": { "$date": "2023-03-11T04:43:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T04:56:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2077, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "40.124.73.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T04:48:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:00:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 490, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.242.72", "classifications": [], "first_seen": { "$date": "2023-03-11T04:50:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:38:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 620, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.160.96.249", "classifications": [], "first_seen": { "$date": "2023-03-11T04:51:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T04:51:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 10" ], "sightings": 31, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "209.97.173.49", "classifications": [], "first_seen": { "$date": "2023-03-11T04:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T04:54:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 125" ], "sightings": 31, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "176.111.173.164", "classifications": [], "first_seen": { "$date": "2023-03-11T04:55:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T04:55:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 19", "ET SCAN Potential SSH Scan" ], "sightings": 62, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "120.50.75.204", "classifications": [], "first_seen": { "$date": "2023-03-11T05:35:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:36:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 93, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "92.70.74.89", "classifications": [], "first_seen": { "$date": "2023-03-11T05:37:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T05:37:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 62, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "128.199.80.214", "classifications": [], "first_seen": { "$date": "2023-03-11T06:41:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:08:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 27", "ET SCAN Potential SSH Scan" ], "sightings": 1586, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "186.31.95.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T06:53:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:39:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 95", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.226.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T06:53:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:52:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8310, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.158.230.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T06:54:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:34:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window", "(stream_tcp) reset outside window" ], "sightings": 1588, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "220.134.69.71", "classifications": [], "first_seen": { "$date": "2023-03-11T06:55:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T06:59:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "HELLOWORLD", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.156.107.66", "classifications": [], "first_seen": { "$date": "2023-03-11T06:55:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:02:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 152", "ET SCAN Potential SSH Scan" ], "sightings": 1593, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "14.6.30.93", "classifications": [], "first_seen": { "$date": "2023-03-11T07:41:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T07:41:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 10" ], "sightings": 30, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.149.224.82", "classifications": [], "first_seen": { "$date": "2023-03-11T08:41:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T08:41:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "60.174.195.52", "classifications": [], "first_seen": { "$date": "2023-03-11T09:08:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:11:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 690, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "114.38.102.218", "classifications": [], "first_seen": { "$date": "2023-03-11T09:30:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T09:30:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.205.9.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T10:45:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:35:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 496, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.83.65.152", "classifications": [], "first_seen": { "$date": "2023-03-11T11:38:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T11:38:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.40.72.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T11:47:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:48:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 186", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13805, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.233.142.6", "classifications": [], "first_seen": { "$date": "2023-03-11T11:48:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:38:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 630, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.186.0.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T11:49:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:45:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 5", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.102.168", "classifications": [], "first_seen": { "$date": "2023-03-11T12:04:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:06:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2100, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "1.15.85.44", "classifications": [], "first_seen": { "$date": "2023-03-11T12:39:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:39:12Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 1" ], "sightings": 30, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "37.139.128.91", "classifications": [], "first_seen": { "$date": "2023-03-11T12:57:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T12:57:22Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 34" ], "sightings": 30, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.62.197.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T13:04:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:22:17Z" }, "ports": [ 80, 0 ], "reporting_nodes": 3, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7194, "tags": [ "alert", "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.27.138.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T13:24:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:40:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 58", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 924, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "221.167.164.212", "classifications": [], "first_seen": { "$date": "2023-03-11T13:25:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T13:25:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 32" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.233.244.71", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-11T14:20:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:13:44Z" }, "ports": [ 1900, 0, 1434, 161 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 60364, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "167.94.138.125", "classifications": [], "first_seen": { "$date": "2023-03-11T14:34:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T15:41:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 82, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "76.110.167.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T14:40:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T14:41:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3149, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.248.206.39", "classifications": [], "first_seen": { "$date": "2023-03-11T14:41:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T14:41:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) partial start line" ], "sightings": 6297, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "114.67.85.236", "classifications": [], "first_seen": { "$date": "2023-03-11T14:46:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T14:48:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 56, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "194.165.16.8", "classifications": [], "first_seen": { "$date": "2023-03-11T15:07:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T19:21:22Z" }, "ports": [ 3392, 3394 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2920, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "110.42.142.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:21:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:21:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.104.5.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T15:22:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:09:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3140, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.73.16.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T15:25:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:25:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3136, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.176.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T15:27:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:27:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3136, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.198.211.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:37:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T17:21:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3786, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.23.128.72", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:37:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:12:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38989, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "42.101.38.52", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:37:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:29:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38562, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.207.242.234", "classifications": [], "first_seen": { "$date": "2023-03-11T15:37:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:54:56Z" }, "ports": [ 59026, 43482 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 3035, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "60.188.247.77", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:38:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:46:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38635, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "175.6.98.40", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:39:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:34:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38280, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.210.208.108", "classifications": [], "first_seen": { "$date": "2023-03-11T15:36:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:38:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2268, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "155.138.195.176", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:39:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:39:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 30979, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.97.171.2", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:39:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:27:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38248, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "171.244.202.14", "classifications": [], "first_seen": { "$date": "2023-03-11T15:56:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T16:00:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1107, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "223.15.242.11", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:41:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:24:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38145, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.34.83.153", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:42:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:13:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38279, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "74.63.223.228", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:12:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 38198, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "91.148.135.216", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:44:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37658, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "183.56.192.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:44:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:18:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36006, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.94.37.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:28:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37521, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "150.139.216.183", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:46:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:28:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37471, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "61.171.80.151", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:49:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:16:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37628, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.204.158.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:50:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:29:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37263, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "31.222.201.187", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:50:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37378, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "120.71.144.111", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:50:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:25:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37291, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "87.121.99.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:50:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:36:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37122, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.217.53.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:51:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:13:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37552, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.226.60.88", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:51:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:35:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37090, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "42.81.132.185", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:52:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:18:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37348, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "106.225.147.245", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:53:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:21:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37074, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "49.7.229.168", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:12:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 37276, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.178.155.36", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:55:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:36:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36714, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "1.71.138.66", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:55:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36879, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.71.126.184", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:56:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:27:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36736, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.126.239.7", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:17:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36925, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "190.123.44.172", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T15:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T15:57:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 29286, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.209.152.106", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T16:07:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36304, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.220.51.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T16:08:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:22:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 29097, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "144.34.177.92", "classifications": [], "first_seen": { "$date": "2023-03-11T16:04:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T16:04:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 26, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.12", "classifications": [], "first_seen": { "$date": "2023-03-11T16:19:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:43:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "38.54.87.101", "classifications": [], "first_seen": { "$date": "2023-03-11T16:50:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T16:55:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 2132, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "67.205.169.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T16:16:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T16:27:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.174.52.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T16:22:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:33:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2890, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.37.164.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T16:24:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:24:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 2902, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "123.175.96.134", "classifications": [], "first_seen": { "$date": "2023-03-11T16:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T16:47:18Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 2864, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "46.214.65.148", "classifications": [], "first_seen": { "$date": "2023-03-11T16:48:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T16:54:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window", "SSH Login Attempts" ], "sightings": 970987, "tags": [ "tcp", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "34.214.65.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T17:16:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:43:01Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "SURICATA Applayer Wrong direction first Data", "APPLAYER_WRONG_DIRECTION_FIRST_DATA", "invalid_banner", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 15633, "tags": [ "alert", "tcp", "ssh", "anomaly", "http" ], "rule_count": 8, "classification_count": 1 }, { "ioc": "54.198.229.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T17:27:03Z" }, "ja3": [ "b4c1f3d7ee0a286259123c39e5109569" ], "last_seen": { "$date": "2023-03-12T18:01:20Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "ET INFO Request to Hidden Environment File", "ET INFO User-Agent (python-requests) Inbound to Webserver", "SURICATA HTTP unable to match response to request", "UNABLE_TO_MATCH_RESPONSE_TO_REQUEST", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 10670, "tags": [ "alert", "tcp", "ssh", "anomaly", "tls", "http" ], "rule_count": 9, "classification_count": 1 }, { "ioc": "220.120.169.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T17:11:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T17:11:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2724, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.238.4", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-11T17:13:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:46:52Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 6603, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "124.155.152.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T17:16:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T17:16:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2722, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T17:33:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:51:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16126, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.73.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T17:59:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T17:59:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2714, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.61.187.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T18:04:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:11:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40167, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.214.55.109", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T18:35:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:00:55Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8064, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "201.166.236.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T18:42:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:42:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.70.87.103", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T19:00:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:13:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13474, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.155.85.21", "classifications": [], "first_seen": { "$date": "2023-03-11T19:01:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:32:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 14936, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "47.253.33.168", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T19:03:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:45:42Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16212, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.89.156.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T19:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T19:12:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8100, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.57", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-11T19:29:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:24:01Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 30315, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "159.65.28.184", "classifications": [], "first_seen": { "$date": "2023-03-11T18:22:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:22:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62" ], "sightings": 24, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "36.230.128.176", "classifications": [], "first_seen": { "$date": "2023-03-11T18:32:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T18:32:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 48, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "119.29.163.245", "classifications": [], "first_seen": { "$date": "2023-03-11T20:24:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:41:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 840, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "59.26.167.234", "classifications": [], "first_seen": { "$date": "2023-03-11T20:28:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:28:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 57" ], "sightings": 24, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.159.56.215", "classifications": [], "first_seen": { "$date": "2023-03-11T20:38:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:41:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 72, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.217.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T19:36:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T19:36:40Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4044, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.240.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T19:45:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:58:44Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 5487, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "195.140.147.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T20:02:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:11:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3233, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.95.12.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T20:08:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:08:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2688, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.45.128.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T20:20:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:20:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.124.5.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T20:25:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:25:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.135.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T20:29:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:42:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3516, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T20:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:41:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2684, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.153.164.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T20:47:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:47:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.137.157.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T20:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T20:56:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2678, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.152.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T21:05:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:43:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2706, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.150.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T21:07:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:07:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2677, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.34.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T21:16:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:42:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.156.118.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T21:21:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:21:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2674, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.189.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T21:26:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:33:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2734, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.0.125.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T21:43:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:43:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6674, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "154.54.11.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T21:43:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:43:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Time-To-Live Exceeded in Transit" ], "sightings": 2668, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "135.181.207.25", "classifications": [], "first_seen": { "$date": "2023-03-11T21:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:27:15Z" }, "ports": [ 54367 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 31673, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.218.48", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-11T21:52:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:09:43Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 2681, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "193.24.41.173", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-11T22:03:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:03:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6665, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.93.16.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T22:15:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:36:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39246, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.135.186.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T22:31:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:33:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2660, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.192.125.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T22:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:43:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5316, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.121.221.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T23:11:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:05:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5258, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.48.137.30", "classifications": [], "first_seen": { "$date": "2023-03-11T23:11:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:11:16Z" }, "ports": [ 11899 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 1326, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.131.128.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T23:20:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:20:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2650, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.255.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T23:20:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:15:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4064, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.250.18.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-11T23:22:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:23:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2648, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.135.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T23:23:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:35:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3620, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.132.227.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T23:48:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:04:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3842, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.208.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-11T23:53:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:53:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2644, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.229.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T00:01:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T00:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2642, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.106.163.105", "classifications": [], "first_seen": { "$date": "2023-03-12T00:04:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:39:20Z" }, "ports": [ 49717, 49297 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2444, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "77.73.131.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T00:05:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:14:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.107.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T00:26:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T00:26:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2638, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T00:34:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:27:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 63102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.185.132.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T00:49:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T00:50:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2636, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.254.100.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T01:23:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T01:23:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2630, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.79.95", "classifications": [], "first_seen": { "$date": "2023-03-12T01:25:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T01:25:43Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1315, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "120.229.35.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T01:32:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T01:32:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2630, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.3.197.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T01:36:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:18:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8382, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.144.17", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-12T01:42:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:01:46Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 2638, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "51.38.237.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T01:49:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:33:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39204, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.100", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-12T01:51:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:28:54Z" }, "ports": [ 161, 0, 1434 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 5291, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "162.243.135.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T01:59:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:06:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3420, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.216.254.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T01:59:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T01:59:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2618, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.106.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T02:08:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:19:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6872, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.224.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T02:09:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:09:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2614, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T02:16:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:27:02Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26854, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.246.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T02:32:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:33:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21432, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.234.245.73", "classifications": [], "first_seen": { "$date": "2023-03-12T02:34:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:34:22Z" }, "ports": [ 81 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 2610, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "138.68.208.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T02:41:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:41:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.232.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T02:46:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:59:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9730, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.20.250.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T02:59:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:59:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7824, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.78.204.28", "classifications": [], "first_seen": { "$date": "2023-03-11T21:50:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T21:54:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1610, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "123.249.126.114", "classifications": [], "first_seen": { "$date": "2023-03-11T21:53:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:10:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum" ], "sightings": 1058, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.142.125.215", "classifications": [], "first_seen": { "$date": "2023-03-11T22:00:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:00:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 23, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "109.164.205.47", "classifications": [], "first_seen": { "$date": "2023-03-11T22:26:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:26:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 46, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "217.144.216.23", "classifications": [], "first_seen": { "$date": "2023-03-11T22:52:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T22:52:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 23, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "52.203.158.87", "classifications": [], "first_seen": { "$date": "2023-03-11T23:08:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:12:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1541, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "27.151.1.54", "classifications": [], "first_seen": { "$date": "2023-03-11T23:22:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:38:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1173, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "54.242.109.112", "classifications": [], "first_seen": { "$date": "2023-03-11T23:51:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-11T23:55:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 322, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "47.253.56.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T01:20:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:15:56Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35, "tags": [ "ssh", "tcp", "ssh", "ssh", "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.145.244.33", "classifications": [], "first_seen": { "$date": "2023-03-12T01:44:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T01:44:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 138, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.204.25.102", "classifications": [], "first_seen": { "$date": "2023-03-12T02:20:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T02:21:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1472, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "110.172.169.130", "classifications": [], "first_seen": { "$date": "2023-03-12T03:11:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:16:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 253, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "191.255.95.208", "classifications": [], "first_seen": { "$date": "2023-03-12T03:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:15:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 138, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.208.141.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T03:05:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:05:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2606, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.214.134.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T03:05:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:05:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.214.134.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T03:07:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:07:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2605, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T03:10:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:10:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2604, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.137.75.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T03:11:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:11:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2604, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.207.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T03:19:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:19:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2602, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.253.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T03:28:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:04:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2994, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.224.214.98", "classifications": [], "first_seen": { "$date": "2023-03-12T04:15:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:15:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 21, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.178.244.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:23:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:00:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2312, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.36.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:30:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:14:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8677, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.129.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T03:37:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:54:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.64.45.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T03:53:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:08:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11637, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.120.98.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T03:54:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:49:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23603, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.97.136.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T03:56:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:06:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 19" ], "sightings": 5179, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.192.20", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-12T03:57:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T03:57:06Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5180, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "137.184.112.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T03:57:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:19:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12980, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.142.125.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T04:06:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:56:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5122, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T04:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:40:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5385, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.44.238.206", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-12T04:30:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:41:36Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 36841, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "36.66.243.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:43:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:58:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 15388, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.93.217.224", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-12T04:44:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:44:39Z" }, "ports": [ 139, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 3849, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "59.80.34.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:44:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:40:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "78.69.82.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T04:46:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:04:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15114, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.8.154.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:51:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:08:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8963, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.254.240.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:51:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:44:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11531, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.190.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:51:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:51:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1282, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "207.154.226.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:54:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:32:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32811, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.3.139.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:54:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:07:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21459, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.50.111.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:55:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:09:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11522, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.137.5", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-12T04:56:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:50:47Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 16021, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "143.110.227.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:57:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:12:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12793, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.231.95.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T05:04:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:04:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Network Unreachable" ], "sightings": 2560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.151.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T05:17:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:04:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6658, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.145.167.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T05:18:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T05:18:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.216.182.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T05:28:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:57:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.213.66", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-12T06:04:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:45:10Z" }, "ports": [ 0, 162 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 2545, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "78.203.42.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T06:06:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T06:06:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2536, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.165", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-12T06:07:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:18:01Z" }, "ports": [ 0, 69 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 2540, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.195.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T06:13:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T06:13:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.189.13.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T06:15:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:10:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4915, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T06:15:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:57:05Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 24839, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.255.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T06:16:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:51:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4178, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.229.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T06:55:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:34:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2550, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.138.197.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T06:56:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:32:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 14251, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.175.156.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T06:56:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:33:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16842, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.68.185.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T06:56:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:11:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10113, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.157.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T06:56:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:06:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6324, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.147.235.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T06:57:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:13:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11374, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.50.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T06:58:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:10:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12640, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.18.181.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T07:09:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:20:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.26.216.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T07:12:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:58:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11940, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.205.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T07:12:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:27:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15132, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.128", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-12T07:21:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:03:57Z" }, "ports": [ 69, 0, 1900, 80 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "(stream_tcp) data on SYN packet" ], "sightings": 9738, "tags": [ "udp", "tftp", "icmp", "tcp", "http" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "1.170.112.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T07:26:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:26:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2519, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T07:43:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:43:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2514, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.90", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-12T07:48:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:54:26Z" }, "ports": [ 161, 0, 22 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 5037, "tags": [ "udp", "snmp", "icmp", "tcp", "ssh" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "120.29.77.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T07:51:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:51:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2514, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.187.179.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T08:26:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:26:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.85.124.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:34:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:47:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11273, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.157.26.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:34:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:50:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12520, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.35.173.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:36:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:57:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12511, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.118.99.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:38:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:44:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6263, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.244.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:38:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:52:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11266, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.186.145.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T08:45:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:45:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2504, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.56.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:56:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:16:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23056, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.72.162.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:59:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:15:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13735, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T08:59:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:59:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2500, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.93.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:59:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:10:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9994, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "199.80.54.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T09:04:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:52:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.99.89.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T09:05:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:20:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9979, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.124.32.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T09:22:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:22:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2492, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.187.177.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T09:40:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:40:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2488, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.159.199.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T09:44:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:36:36Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 20732, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.140.114.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T09:49:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:04:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11168, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.54.107.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T09:50:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:10:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11135, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.162.30.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T09:52:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:06:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9909, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.145.123.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T09:54:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:17:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9881, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.178.17.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T09:54:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:07:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12377, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.224.186.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T09:55:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:51:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2997, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.220.254.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T10:02:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:18:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11110, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.36.43.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T10:08:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:41:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24542, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.254.137.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T10:09:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:17:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23269, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.143.235.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T10:09:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:22:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9838, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.230.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T10:14:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:32:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7260, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.55.224.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T10:22:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:22:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2454, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.245.77.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T10:27:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:49:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9754, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.245.80.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T10:28:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:42:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6117, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.162.246.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T10:40:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:40:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2450, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.152.52.93", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-12T10:40:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:06:12Z" }, "ports": [ 0, 1023, 161, 32771, 162, 53, 5060, 1900, 8332, 49156, 623, 8090 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) TCP portscan", "(port_scan) UDP portscan", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP trap udp", "PROTOCOL-DNS named version attempt", "(sip) content length mismatch", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 97527, "tags": [ "icmp", "tcp", "udp", "snmp", "snmptrap" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "206.189.75.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T10:49:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:29:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12133, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.171.156.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T10:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:10:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13314, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.74.104.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T10:54:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:54:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2424, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.97.120.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-12T10:54:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:54:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6060, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "222.128.173.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T10:56:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:27:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4334, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.156.77.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T11:09:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:09:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2419, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "153.204.140.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T11:21:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:22:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2418, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.174.26.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T11:24:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:24:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2418, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.179.32.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T11:26:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:26:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2418, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.3.136.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T11:34:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:34:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2418, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-12T11:38:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:38:55Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3624, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "27.109.247.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T11:44:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:45:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2416, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.184.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:22:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24014, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.223.226.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:01:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:14:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8412, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.131.33.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:03:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:13:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9615, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.169.183.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:04:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:38:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23960, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.92.148.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:05:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:20:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12002, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "116.203.137.128", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-03-12T12:14:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:06:27Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get" ], "sightings": 28123, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.47.12.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:16:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:17:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2396, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.79.68.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:18:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:37:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7196, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.187.32.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:25:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:25:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1196, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.223.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:27:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:19:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13092, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "100.38.226.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T12:34:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:34:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2392, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.199.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T12:44:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:07:00Z" }, "ports": [ 22, 0 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1200, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.229.18", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-12T12:45:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:53:57Z" }, "ports": [ 22, 161, 0 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4462, "tags": [ "tcp", "ssh", "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "57.128.41.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T13:02:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:35:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3248, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.210.33.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T13:04:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:04:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2384, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.124.32.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T13:15:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:15:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2382, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.165.248", "classifications": [], "first_seen": { "$date": "2023-03-12T13:16:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:54:30Z" }, "ports": [ 22836, 15024, 2435, 60255 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4242, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.105.33.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T13:26:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:26:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2381, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.234.2.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T13:27:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:48:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10745, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.227.234.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T13:29:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:42:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10689, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "163.197.44.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T13:30:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:48:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11868, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.59.11.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T13:31:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:42:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7127, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.117.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T13:40:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:40:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.152.118.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T13:42:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:24:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13952, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.103.169.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T13:49:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:49:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2376, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.189.12.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T14:01:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:49:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14284, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.235.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T14:09:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:46:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2371, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.140", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-12T14:13:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:19:36Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4401, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.242.1.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T14:32:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:56:45Z" }, "ports": [ 1434, 0, 7001 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "POLICY-OTHER AFS access" ], "sightings": 18870, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "192.241.193.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T14:37:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:46:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.250.60.72", "classifications": [], "first_seen": { "$date": "2023-03-12T14:38:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:38:46Z" }, "ports": [ 81 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 2358, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "46.101.158.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T14:56:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:56:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2358, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.151.120.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T15:04:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:04:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2358, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.186.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T15:06:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:06:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2354, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.1.213.19", "classifications": [], "first_seen": { "$date": "2023-03-12T04:33:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T04:33:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 82" ], "sightings": 20, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.57.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:33:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:35:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 444, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.199.35.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T04:33:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:55:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.146.203.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T06:59:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:08:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 3", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2053, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.141.33", "classifications": [], "first_seen": { "$date": "2023-03-12T07:04:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:01:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25", "ET SCAN Potential SSH Scan" ], "sightings": 747, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "101.36.118.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T07:04:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:33:31Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 1", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 126043, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.251.236.115", "classifications": [], "first_seen": { "$date": "2023-03-12T07:05:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:21:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 153, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "125.229.17.98", "classifications": [], "first_seen": { "$date": "2023-03-12T07:06:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:07:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "178.128.165.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T07:06:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:26:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2270, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.179.230", "classifications": [], "first_seen": { "$date": "2023-03-12T07:08:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:08:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 58" ], "sightings": 20, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.115.130.77", "classifications": [], "first_seen": { "$date": "2023-03-12T07:11:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:22:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 38, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "211.180.244.104", "classifications": [], "first_seen": { "$date": "2023-03-12T07:20:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:20:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 19, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.227.113.60", "classifications": [], "first_seen": { "$date": "2023-03-12T07:35:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T07:35:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.49.77.211", "classifications": [], "first_seen": { "$date": "2023-03-12T07:46:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:03:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "SURICATA STREAM TIMEWAIT ACK with wrong seq", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1425, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 7, "classification_count": 0 }, { "ioc": "125.141.139.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T08:15:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:33:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 24", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5445, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.60.104.104", "classifications": [], "first_seen": { "$date": "2023-03-12T08:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:13:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 66, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.12.224.136", "classifications": [], "first_seen": { "$date": "2023-03-12T08:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:09:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 110", "ET SCAN Potential SSH Scan" ], "sightings": 988, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "115.133.19.187", "classifications": [], "first_seen": { "$date": "2023-03-12T08:36:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T08:36:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 19, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "205.185.122.106", "classifications": [], "first_seen": { "$date": "2023-03-12T09:23:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T09:23:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.142.105.8", "classifications": [], "first_seen": { "$date": "2023-03-12T10:42:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:43:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 228, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "115.231.76.5", "classifications": [], "first_seen": { "$date": "2023-03-12T10:48:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T10:51:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 912, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "152.136.235.236", "classifications": [], "first_seen": { "$date": "2023-03-12T11:07:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:23:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1425, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "45.171.46.154", "classifications": [], "first_seen": { "$date": "2023-03-12T11:13:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:07:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157", "ET SCAN Potential SSH Scan" ], "sightings": 988, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.139.113.230", "classifications": [], "first_seen": { "$date": "2023-03-12T11:22:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:23:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 684, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "124.222.151.130", "classifications": [], "first_seen": { "$date": "2023-03-12T11:34:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T11:36:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 190, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "188.166.224.80", "classifications": [], "first_seen": { "$date": "2023-03-12T12:38:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T12:42:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 494, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "24.193.25.212", "classifications": [], "first_seen": { "$date": "2023-03-12T13:25:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:25:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 14" ], "sightings": 57, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.137.228.95", "classifications": [], "first_seen": { "$date": "2023-03-12T13:37:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:37:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 19, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.142.125.11", "classifications": [], "first_seen": { "$date": "2023-03-12T13:39:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T13:39:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "134.209.69.41", "classifications": [], "first_seen": { "$date": "2023-03-12T14:16:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:16:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 32" ], "sightings": 19, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.69.148.77", "classifications": [], "first_seen": { "$date": "2023-03-12T14:19:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:02:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 138" ], "sightings": 513, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.59.25.90", "classifications": [], "first_seen": { "$date": "2023-03-12T14:19:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:49:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 190, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.198.133.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T14:19:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:54:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 44", "ET 3CORESec Poor Reputation IP group 13", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1133, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "122.176.55.24", "classifications": [], "first_seen": { "$date": "2023-03-12T14:23:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T14:39:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 171, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.173.86.236", "classifications": [], "first_seen": { "$date": "2023-03-12T15:00:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:56:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 318, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.227.190.23", "classifications": [], "first_seen": { "$date": "2023-03-12T15:18:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:42:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 152, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.195.57", "classifications": [], "first_seen": { "$date": "2023-03-12T15:18:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:18:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.131.62.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T15:19:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:51:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6425, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.232.132.79", "classifications": [], "first_seen": { "$date": "2023-03-12T15:20:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:49:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 73", "ET SCAN Potential SSH Scan" ], "sightings": 643, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "167.71.102.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T15:34:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:58:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6928, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.134.31.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T15:51:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:51:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2348, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.242.130.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T15:59:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T15:59:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2346, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.197.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:06:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:06:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1172, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.151.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:06:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:38:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23302, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.135.204.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:07:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:07:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1172, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.165.219.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:08:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1172, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.156.0.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:25:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11676, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.105.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:09:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:20:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9350, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.139.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:11:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:12:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SSH Login Attempts" ], "sightings": 5855, "tags": [ "tcp", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.39.122.193", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-12T16:13:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:24:04Z" }, "ports": [ 0, 1900, 161, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 165010, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "112.240.57.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:18:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:31:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5821, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.125.75.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T16:23:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:33:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8142, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.124.32.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T16:25:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:25:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2328, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.3.131.128", "classifications": [], "first_seen": { "$date": "2023-03-12T16:01:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:01:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 108, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "154.92.15.156", "classifications": [], "first_seen": { "$date": "2023-03-12T16:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T17:02:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 197, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.243.133.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T16:52:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:45:31Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3483, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "205.210.31.47", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-12T16:55:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T16:55:56Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4636, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "171.15.158.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T17:03:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T17:03:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 2313, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.94.189.182", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-12T17:08:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:05:11Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 2324, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "138.197.101.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T17:14:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:46:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.174.20", "classifications": [], "first_seen": { "$date": "2023-03-12T17:08:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T17:10:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 238, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "120.253.225.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T17:34:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:41:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2796, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.69", "classifications": [], "first_seen": { "$date": "2023-03-12T17:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T17:37:38Z" }, "ports": [ 5523, 551 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2298, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "223.83.213.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T17:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:56:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6133, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.42.95.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T17:57:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T17:57:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2291, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.59.144.56", "classifications": [], "first_seen": { "$date": "2023-03-12T18:19:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:07:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 316, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.250.28.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T18:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:09:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 542, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "104.248.232.207", "classifications": [], "first_seen": { "$date": "2023-03-12T18:22:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T01:44:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 12" ], "sightings": 23, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.131.212.19", "classifications": [], "first_seen": { "$date": "2023-03-12T18:52:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:37:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 230, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.22.51.113", "classifications": [], "first_seen": { "$date": "2023-03-12T18:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:28:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 71", "ET SCAN Potential SSH Scan" ], "sightings": 522, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "161.35.33.197", "classifications": [], "first_seen": { "$date": "2023-03-12T18:53:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:19:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 290, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "142.93.196.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T18:54:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:20:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 42", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 64, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.216.197", "classifications": [], "first_seen": { "$date": "2023-03-12T18:54:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:25:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "ET SCAN Potential SSH Scan" ], "sightings": 524, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.178.139.28", "classifications": [], "first_seen": { "$date": "2023-03-12T18:57:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:29:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 163", "ET SCAN Potential SSH Scan" ], "sightings": 506, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "52.27.236.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T18:59:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:42:51Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "SURICATA Applayer Wrong direction first Data", "APPLAYER_WRONG_DIRECTION_FIRST_DATA", "ET INFO Request to Hidden Environment File", "invalid_banner", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(ssh) server version string overflow" ], "sightings": 10282, "tags": [ "alert", "tcp", "ssh", "anomaly", "http" ], "rule_count": 10, "classification_count": 1 }, { "ioc": "220.71.79.7", "classifications": [], "first_seen": { "$date": "2023-03-12T19:19:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:19:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 31" ], "sightings": 28, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.86.47.17", "classifications": [], "first_seen": { "$date": "2023-03-12T20:04:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:05:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 714, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "198.211.96.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T18:17:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T18:17:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2284, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T18:19:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:47:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.103", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-12T18:26:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:41:37Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 4544, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.3.76.16", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-12T18:30:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T02:44:59Z" }, "ports": [ 65476, 0, 5060 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13194, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "85.3.6.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T18:41:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T18:41:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2279, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.38.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T18:47:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:03:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12507, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.202.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T18:48:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:01:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9101, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.222.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T18:50:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:00:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7964, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.216.171.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T19:00:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:00:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1134, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.129.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T19:19:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:33:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9028, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.50.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T19:19:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:27:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9070, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.236.71.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T19:31:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:44:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11244, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.243.248.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T19:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:59:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5608, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.185.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T19:48:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:39:42Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 9053, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.99.4.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T19:53:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:26:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26892, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.255.195.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T19:55:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:08:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11181, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "86.98.12.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T19:59:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T19:59:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2242, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.240.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T20:09:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:09:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2232, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.255.193.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T20:25:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:33:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5574, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.11.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T20:26:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:27:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5575, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.130", "classifications": [], "first_seen": { "$date": "2023-03-12T20:31:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:36:40Z" }, "ports": [ 33162, 33456, 33634 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2347, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "130.162.42.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T20:45:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:31:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 8235, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.25.119.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T20:47:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:01:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10021, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.172.192.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T20:48:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:48:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2228, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.106.229", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T20:51:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:18:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3154, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "97.120.183.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T20:56:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:56:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2226, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.232.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T21:03:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:08:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4903, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.92.70.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T21:10:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:49:56Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 21" ], "sightings": 14389, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.152.219.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T21:12:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:27:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11057, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.237.145.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T21:27:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:39:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13732, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.217.207.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T21:27:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:41:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9924, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.172.5.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T21:28:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:28:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2206, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.221.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T21:34:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:32:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2540, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.207.85", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-12T21:45:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:40:40Z" }, "ports": [ 0, 162 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 3046, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.12.255.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T21:57:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:58:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13684, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.110.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T21:57:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:45:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4200, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.190.132.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T21:58:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:13:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12064, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.254.236.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T21:59:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:59:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2196, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.150.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T22:00:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:14:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9870, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.224.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T22:04:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:43:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2212, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.221.17.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T22:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:37:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6597, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.102.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T22:15:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:15:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2190, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.205.132.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T22:32:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:37:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10940, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.151.184.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T22:49:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:49:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5460, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "122.165.93.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T22:52:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:03:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8735, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.112.72.170", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-12T23:09:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:04:00Z" }, "ports": [ 0, 1900, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 26739, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "64.227.99.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T23:15:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:05:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5544, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.66.80.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-12T23:20:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:21:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8728, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.7.67.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T23:41:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:18:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12476, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "174.138.54.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T23:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:56:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10875, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.191.99.72", "classifications": [], "first_seen": { "$date": "2023-03-12T23:55:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:55:44Z" }, "ports": [ 8080 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 2174, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.236.176.63", "classifications": [], "first_seen": { "$date": "2023-03-13T00:04:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:04:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 1086, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "161.35.236.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T00:04:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:10:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3362, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.235.202.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T00:05:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:05:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2172, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T00:13:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2174, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.104.93.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T00:17:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:47:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2652, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.49.170.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T00:31:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:32:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2168, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T00:38:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:28:54Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 9459, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "184.105.139.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T00:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:43:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.186.145.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T00:52:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:02:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7567, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.187.106.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T00:59:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:00:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2162, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.45.138.197", "classifications": [], "first_seen": { "$date": "2023-03-13T01:02:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:02:55Z" }, "ports": [ 3020 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2162, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "27.131.36.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T01:22:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:35:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8599, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.200.18.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T01:25:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:25:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.115.78.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T01:35:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:35:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2146, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.200.11.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T01:45:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T02:04:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10707, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.252.143.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T01:47:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:52:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 17128, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.108.40.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T01:49:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:37:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10721, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.66.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T01:54:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:15:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9688, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.18.49.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T01:55:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:58:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12712, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.200.234.151", "classifications": [], "first_seen": { "$date": "2023-03-13T01:57:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:57:20Z" }, "ports": [ 8080 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 2140, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "216.218.206.85", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-13T01:57:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T07:02:19Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6390, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "143.42.74.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T02:05:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:28:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4082, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.210.6.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T02:38:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T02:38:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2130, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.81", "classifications": [ "Misc activity", "Decode of an RPC Query", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T02:47:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:59:11Z" }, "ports": [ 0, 111, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111", "X11 xdmcp info query" ], "sightings": 2331, "tags": [ "icmp", "udp", "sunrpc", "portmapper", "xdmcp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "172.105.104.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T02:51:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:20:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4088, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T02:58:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:03:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2138, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.23.212.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T03:02:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:02:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2130, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.107.254.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T03:05:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:05:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2130, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.223.21", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T03:17:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:50:12Z" }, "ports": [ 5060, 0, 161 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 4670, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "92.98.137.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T03:21:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:21:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2128, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.55.73.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T03:32:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:32:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2126, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.189.23.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T03:34:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:34:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2126, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.252.11.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T03:50:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:27:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21161, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.180.18.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T03:56:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T03:56:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.90.72.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T03:56:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:18:48Z" }, "ports": [ 0, 1434, 7001 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "POLICY-OTHER AFS access" ], "sightings": 16935, "tags": [ "icmp", "udp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "43.163.200.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T04:05:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:19:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10575, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.80.64.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T04:05:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:18:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9520, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.42.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T04:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:21:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10571, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T04:06:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:11:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7701, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.95.200.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T04:08:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:48:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5960, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "69.25.116.232", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-03-13T04:26:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:45:11Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6312, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "172.105.20.245", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-13T04:30:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:30:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5264, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "141.98.83.216", "classifications": [], "first_seen": { "$date": "2023-03-13T04:32:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:05:08Z" }, "ports": [ 14189, 16502 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1648, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "3.112.13.142", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-13T04:36:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:36:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5256, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "170.64.138.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:02:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:19:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15815, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.250.10.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:02:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:12:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7320, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.52.39.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:02:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:14:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6262, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.108.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T05:02:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:32:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.57.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:03:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:19:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11457, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.65.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:03:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:06:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11543, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.152.62.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T05:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:05:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2096, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.200.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:20:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12495, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.87.208.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:05:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:20:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8325, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.231.213.96", "classifications": [], "first_seen": { "$date": "2023-03-13T05:06:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:06:13Z" }, "ports": [ 6422 ], "reporting_nodes": 1, "rules": [ "(ipv4) IPv4 packet from 'current net' source address" ], "sightings": 2095, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "27.71.25.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:06:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:18:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8334, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T05:21:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:21:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2074, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.193.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T05:26:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:14:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.84.169.222", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T05:27:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:27:38Z" }, "ports": [ 53, 162, 9200, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 4137, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "44.201.131.200", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T05:28:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:28:14Z" }, "ports": [ 161, 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 2067, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.188.87.6", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T05:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:31:23Z" }, "ports": [ 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp" ], "sightings": 2064, "tags": [ "tcp", "snmptrap" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T05:33:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:21:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5930, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.188.212.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T05:33:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:33:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2064, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T05:40:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:40:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2060, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.118.57", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T05:52:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:44:00Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 21358, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.235.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T05:53:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:34:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4702, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.199.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T06:02:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:01:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5714, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.77.231.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T06:15:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:15:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.67.228.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:15:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:33:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11280, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.228.164.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:15:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:43:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20478, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.93.63.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:17:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:28:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5134, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "153.92.210.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:19:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:26:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17524, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.156.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:19:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:31:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 175", "ET SCAN Potential SSH Scan" ], "sightings": 10422, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "170.187.136.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T06:26:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:20:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3990, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.234.237.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:27:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:27:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2052, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T06:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:51:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.98.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T06:38:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:31:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2188, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.185.40.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:38:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:57:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15295, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "174.160.254.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:39:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:59:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 14266, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.197.63.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:39:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:55:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.103.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T06:52:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:16:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.230.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:05:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:58:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.138.18", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T07:06:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:31:28Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 3213, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.104.96.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:14:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:14:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2035, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.102.41.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:14:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:14:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2032, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.152.219.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:24:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:24:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2030, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.102.40.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:25:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:25:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2030, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.24.102.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:25:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:25:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2030, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.81.140.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:29:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:40:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2036, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.237.173.210", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:29:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:33:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40452, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.104.96.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:32:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:32:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2021, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.171.199.102", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:33:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:33:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5044, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.104.96.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:38:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2016, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.104.96.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:39:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:39:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2016, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.133.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:41:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:16:18Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 2055, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.104.96.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:43:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:43:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2016, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.149.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:57:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2962, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.128.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:52:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:31:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.102.40.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T07:56:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:56:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2016, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.149.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:03:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:19:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2028, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.53.63.104", "classifications": [], "first_seen": { "$date": "2023-03-13T08:04:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:41:37Z" }, "ports": [ 41433, 51433, 5433, 61433, 4433 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 6771, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.104.96.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:08:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2016, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.167.46.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T08:09:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:25:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10071, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.121.216.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T08:13:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:28:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10068, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.102.40.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:20:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:20:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2014, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.81.69.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T08:23:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:37:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10059, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.105.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T08:23:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:35:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8049, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.142.125.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:29:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:03:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2024, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.104.96.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:43:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:43:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2006, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:53:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:09:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2912, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.80.185.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T08:54:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:55:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2006, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.104.96.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:56:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:56:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2006, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.207.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:56:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:54:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2025, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:56:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:56:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2004, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "132.148.165.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T08:58:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:11:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9018, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.83.67.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T08:59:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T08:59:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2004, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.102.40.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T09:07:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:07:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2004, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.153.245.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T09:08:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:09:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2004, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.193.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T09:24:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:24:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1002, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "131.0.200.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T09:27:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:41:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8009, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.84.76.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T09:28:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:37:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7009, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.104.17.24", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-13T09:40:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:11:37Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7896, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.24.100.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T09:41:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:41:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10002, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "158.69.73.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T09:51:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:51:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1998, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.251.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T10:03:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:56:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3764, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "40.118.30.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T10:06:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:59:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 28846, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.69.254.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T10:09:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:19:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6980, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "99.33.195.167", "classifications": [], "first_seen": { "$date": "2023-03-12T20:20:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T20:21:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 92", "ET SCAN Potential SSH Scan" ], "sightings": 91, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "47.53.169.170", "classifications": [], "first_seen": { "$date": "2023-03-12T21:48:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T21:49:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 26, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "152.89.45.189", "classifications": [], "first_seen": { "$date": "2023-03-12T22:00:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:21:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 91, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.65.27.132", "classifications": [], "first_seen": { "$date": "2023-03-12T22:18:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:18:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 52, "tags": [ "ssh", "tcp", "ssh", "OpenSSH-keyscan", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "137.184.170.221", "classifications": [], "first_seen": { "$date": "2023-03-12T22:31:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T22:31:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 13, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.233.253.62", "classifications": [], "first_seen": { "$date": "2023-03-12T23:00:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:44:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 217, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "54.37.139.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-12T23:04:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:59:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 168", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8229, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "90.176.240.32", "classifications": [], "first_seen": { "$date": "2023-03-12T23:07:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:31:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 117, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.127.141.23", "classifications": [], "first_seen": { "$date": "2023-03-12T23:25:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-12T23:25:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 26, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "129.10.47.170", "classifications": [], "first_seen": { "$date": "2023-03-13T00:29:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T00:44:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 1105, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "147.182.160.7", "classifications": [], "first_seen": { "$date": "2023-03-13T00:47:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:31:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 260, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.223.29.248", "classifications": [], "first_seen": { "$date": "2023-03-13T00:47:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:34:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 247, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.36.19.17", "classifications": [], "first_seen": { "$date": "2023-03-13T00:48:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:42:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 168", "ET SCAN Potential SSH Scan" ], "sightings": 637, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "139.99.53.153", "classifications": [], "first_seen": { "$date": "2023-03-13T00:48:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:03:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 91, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "178.62.63.15", "classifications": [], "first_seen": { "$date": "2023-03-13T00:49:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:35:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 85", "ET SCAN Potential SSH Scan" ], "sightings": 637, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "42.1.65.117", "classifications": [], "first_seen": { "$date": "2023-03-13T01:18:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:47:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 169, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.241.114.75", "classifications": [], "first_seen": { "$date": "2023-03-13T01:21:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:21:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 65" ], "sightings": 13, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "2600:9000:24f4:ea00:0000:df71:8000:93a1", "classifications": [], "first_seen": { "$date": "2023-03-13T01:21:46Z" }, "ja3": [ "df669e7ea913f1ac0c0cce9a201a2ec1" ], "last_seen": { "$date": "2023-03-13T01:21:46Z" }, "ports": [ 44228 ], "reporting_nodes": 1, "rules": [], "sightings": 13, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "41.72.219.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T01:23:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:37:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 144", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2466, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.70.0.122", "classifications": [], "first_seen": { "$date": "2023-03-13T01:28:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T02:01:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 107", "ET 3CORESec Poor Reputation IP group 24", "ET SCAN Potential SSH Scan" ], "sightings": 468, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "182.23.23.42", "classifications": [], "first_seen": { "$date": "2023-03-13T01:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T01:59:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 104, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.250.13", "classifications": [], "first_seen": { "$date": "2023-03-13T02:32:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:51:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.223.79.49", "classifications": [], "first_seen": { "$date": "2023-03-13T04:28:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:28:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 60" ], "sightings": 13, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.189.223.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T04:49:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:22:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 61, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.29.76", "classifications": [], "first_seen": { "$date": "2023-03-13T04:50:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:37:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 160", "ET 3CORESec Poor Reputation IP group 36", "ET SCAN Potential SSH Scan" ], "sightings": 689, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "189.172.235.61", "classifications": [], "first_seen": { "$date": "2023-03-13T04:51:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:47:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 273, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "147.182.218.64", "classifications": [], "first_seen": { "$date": "2023-03-13T04:52:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:39:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 50", "ET SCAN Potential SSH Scan" ], "sightings": 650, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "118.194.231.180", "classifications": [], "first_seen": { "$date": "2023-03-13T04:53:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:49:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 260, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.193.79.18", "classifications": [], "first_seen": { "$date": "2023-03-13T04:58:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T04:58:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 13, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "193.163.125.197", "classifications": [], "first_seen": { "$date": "2023-03-13T05:16:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:16:45Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 13, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.92.224.215", "classifications": [], "first_seen": { "$date": "2023-03-13T05:42:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T05:42:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 13, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.232.122.142", "classifications": [], "first_seen": { "$date": "2023-03-13T06:26:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:30:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 351, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "112.20.185.169", "classifications": [], "first_seen": { "$date": "2023-03-13T06:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:03:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 962, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "207.242.181.107", "classifications": [], "first_seen": { "$date": "2023-03-13T06:49:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T06:50:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 949, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "96.78.175.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T06:50:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:52:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6023, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.31.56.247", "classifications": [], "first_seen": { "$date": "2023-03-13T07:16:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T07:40:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 390, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "112.166.144.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T08:22:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:42:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4301, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.91.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T08:23:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:20:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 127, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.99.173.162", "classifications": [], "first_seen": { "$date": "2023-03-13T08:23:32Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:34:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 24", "ET 3CORESec Poor Reputation IP group 11" ], "sightings": 1159, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "211.154.195.84", "classifications": [], "first_seen": { "$date": "2023-03-13T09:00:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:00:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 91, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.5", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.241.174.252", "classifications": [], "first_seen": { "$date": "2023-03-13T09:10:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:11:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 78, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "209.126.83.40", "classifications": [], "first_seen": { "$date": "2023-03-13T09:28:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:31:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.210.196.55", "classifications": [], "first_seen": { "$date": "2023-03-13T09:38:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:43:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 24", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 962, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "87.236.176.201", "classifications": [], "first_seen": { "$date": "2023-03-13T09:43:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T09:46:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.183.183.225", "classifications": [], "first_seen": { "$date": "2023-03-13T10:43:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:43:14Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 2979, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.131.16", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-13T11:06:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:48:44Z" }, "ports": [ 161, 0, 1900 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 4035, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "194.195.241.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T11:09:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:26:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10852, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.166.23.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T10:42:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1078, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.122.184", "classifications": [], "first_seen": { "$date": "2023-03-13T10:48:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T10:52:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 576, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "27.151.14.253", "classifications": [], "first_seen": { "$date": "2023-03-13T11:11:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:11:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.219.180.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T11:29:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:01:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 428, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "139.162.190.203", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T11:37:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:44:58Z" }, "ports": [ 22, 705 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP AgentX/tcp request" ], "sightings": 15, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.44.114.145", "classifications": [], "first_seen": { "$date": "2023-03-13T11:44:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:00:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 93, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "83.40.14.216", "classifications": [], "first_seen": { "$date": "2023-03-13T11:45:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:09:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 90, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "153.192.179.240", "classifications": [], "first_seen": { "$date": "2023-03-13T11:48:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:48:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "64.62.197.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T11:17:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:17:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1974, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.163.204.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T11:28:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:11:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1994, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.163.220.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T11:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T11:54:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4910, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.232.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T12:05:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:05:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1960, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.191.92.4", "classifications": [], "first_seen": { "$date": "2023-03-13T12:10:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:10:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 6", "ET 3CORESec Poor Reputation IP group 2" ], "sightings": 22, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.120.103.230", "classifications": [], "first_seen": { "$date": "2023-03-13T12:13:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:07:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 169", "ET SCAN Potential SSH Scan" ], "sightings": 564, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "134.209.227.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T12:14:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T01:16:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10805, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.209.153.107", "classifications": [], "first_seen": { "$date": "2023-03-13T12:14:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:01:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 218, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.99.228.159", "classifications": [], "first_seen": { "$date": "2023-03-13T12:14:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:58:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 76", "ET SCAN Potential SSH Scan" ], "sightings": 538, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "121.18.159.58", "classifications": [], "first_seen": { "$date": "2023-03-13T12:29:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:46:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 869, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "73.251.209.69", "classifications": [], "first_seen": { "$date": "2023-03-13T12:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:55:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan" ], "sightings": 121, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "146.19.217.233", "classifications": [], "first_seen": { "$date": "2023-03-13T12:37:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:33:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 203, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "50.217.175.10", "classifications": [], "first_seen": { "$date": "2023-03-13T12:38:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:38:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 162", "ET 3CORESec Poor Reputation IP group 38" ], "sightings": 22, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "77.223.104.10", "classifications": [], "first_seen": { "$date": "2023-03-13T12:39:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:30:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 223, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "180.166.175.229", "classifications": [], "first_seen": { "$date": "2023-03-13T12:41:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:41:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 44, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "57.128.199.72", "classifications": [], "first_seen": { "$date": "2023-03-13T12:42:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:42:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 11, "tags": [ "ssh", "tcp", "ssh", "OpenSSH", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "5.171.213.231", "classifications": [], "first_seen": { "$date": "2023-03-13T13:08:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:08:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.241.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T12:17:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:17:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1958, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "156.247.204.25", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T12:28:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:14:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 9885, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "31.30.175.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T12:28:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T12:28:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1956, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.173.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T13:10:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:41:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.222.202.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T13:12:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:45:28Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10496, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.185.26.240", "classifications": [], "first_seen": { "$date": "2023-03-13T13:12:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:12:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 143" ], "sightings": 9, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "76.95.32.130", "classifications": [], "first_seen": { "$date": "2023-03-13T13:12:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:49:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 177" ], "sightings": 261, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.196.158.214", "classifications": [], "first_seen": { "$date": "2023-03-13T13:14:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:30:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 27, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "5.171.215.51", "classifications": [], "first_seen": { "$date": "2023-03-13T13:20:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:37:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 126, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "78.187.21.105", "classifications": [], "first_seen": { "$date": "2023-03-13T13:46:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:20:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 144, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "202.111.2.218", "classifications": [], "first_seen": { "$date": "2023-03-13T13:46:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:00:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 27, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.153.171.191", "classifications": [], "first_seen": { "$date": "2023-03-13T13:48:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:23:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 135, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "134.209.190.88", "classifications": [], "first_seen": { "$date": "2023-03-13T13:49:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:49:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 31" ], "sightings": 9, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "78.192.56.254", "classifications": [], "first_seen": { "$date": "2023-03-13T13:49:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:49:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 178", "ET 3CORESec Poor Reputation IP group 43" ], "sightings": 18, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "218.255.103.194", "classifications": [], "first_seen": { "$date": "2023-03-13T13:54:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:18:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 180, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.156.27.23", "classifications": [], "first_seen": { "$date": "2023-03-13T14:07:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:43:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 146, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "74.211.97.102", "classifications": [], "first_seen": { "$date": "2023-03-13T14:09:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:41:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 129, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.161.50.120", "classifications": [], "first_seen": { "$date": "2023-03-13T14:10:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:45:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 41" ], "sightings": 336, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.126.8.143", "classifications": [], "first_seen": { "$date": "2023-03-13T14:10:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:10:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 131" ], "sightings": 9, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "210.91.154.187", "classifications": [], "first_seen": { "$date": "2023-03-13T14:10:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:51:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 126" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.102.40.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T13:03:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:03:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1948, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.102.41.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T13:03:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:03:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1948, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.229.1.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T13:11:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:11:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1946, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.92.107.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T13:11:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:35:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 140" ], "sightings": 10698, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "143.42.191.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T13:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:18:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.24.96.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T13:15:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:15:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1944, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.24.96.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T13:15:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:15:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1944, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.157.29.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T13:21:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:34:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8748, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.10.73.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T13:21:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:40:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 21332, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.132.167.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T13:22:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:46:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13842, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.80.89.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T13:24:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T13:39:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10692, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.255.220.120", "classifications": [], "first_seen": { "$date": "2023-03-13T14:29:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:29:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 16, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "114.33.59.227", "classifications": [], "first_seen": { "$date": "2023-03-13T14:58:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:58:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 16, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "123.28.106.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T14:08:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:08:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1940, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-13T14:10:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:10:00Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2907, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.199.57", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-13T14:13:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:13:12Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2907, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.153.20.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T14:19:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:34:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9661, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.21.36.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T14:20:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:39:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23175, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "199.195.254.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T14:22:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:39:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10613, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.71.61.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T14:22:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:40:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11584, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.159.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T14:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:35:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5793, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.83.183.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T14:37:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:54:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11035, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.102.40.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T14:40:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:40:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1924, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.102.41.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T14:40:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:40:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1924, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.44.247.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T14:51:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:06:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7679, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.24.96.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T14:55:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:55:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1922, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.24.96.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T14:55:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T14:55:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1922, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.230.153.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T15:00:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:00:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 959, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.171.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T15:02:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:30:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20108, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.102.41.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T15:13:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:13:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1916, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.102.40.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T15:13:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:13:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1916, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.132.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T15:15:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:35:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3688, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.24.96.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T15:27:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:27:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1912, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.24.96.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T15:27:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:27:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1912, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.227", "classifications": [], "first_seen": { "$date": "2023-03-13T15:35:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:36:25Z" }, "ports": [ 16628, 15257 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1912, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "172.105.5.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T15:35:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:09:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.219.246.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T15:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:51:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13365, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.244.78.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T15:37:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:37:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1912, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.89.6.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T15:51:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T15:51:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1906, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T16:02:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:22:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15969, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.79.138.239", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-13T16:12:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:24:59Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5675, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "99.233.50.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T16:13:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:13:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1902, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.148.251.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T16:17:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:17:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1902, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.231.45.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:21:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:22:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1902, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.99.118.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T16:22:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:11:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3766, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.235.148.157", "classifications": [], "first_seen": { "$date": "2023-03-13T16:22:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:22:35Z" }, "ports": [ 8081 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 951, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.180.33.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:36:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:07:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19861, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.104.87.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T16:41:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:41:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1899, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.104.96.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T16:41:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:41:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.141.44.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:41:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:56:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8518, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.85.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:41:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:31:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24976, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.168.121.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:42:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:56:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8523, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.85.160.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:56:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6625, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.79.185.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:43:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:58:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 10482, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.247.147.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:43:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:59:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8509, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "168.63.152.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:45:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:40:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 17892, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.225.212.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T16:47:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:58:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7563, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.157.223.18", "classifications": [], "first_seen": { "$date": "2023-03-13T17:16:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:16:26Z" }, "ports": [ 282 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 941, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "94.250.253.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T17:33:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:33:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1878, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.192.228.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T17:49:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:49:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1878, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.204.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T17:58:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:32:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3586, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.197.32.150", "classifications": [], "first_seen": { "$date": "2023-03-13T16:45:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35", "ET 3CORESec Poor Reputation IP group 12" ], "sightings": 14, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.38.47.78", "classifications": [], "first_seen": { "$date": "2023-03-13T16:46:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:36:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 154, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.22.185.202", "classifications": [], "first_seen": { "$date": "2023-03-13T16:46:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:35:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 133, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "130.61.232.86", "classifications": [], "first_seen": { "$date": "2023-03-13T16:47:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T16:47:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "27.254.235.4", "classifications": [], "first_seen": { "$date": "2023-03-13T16:47:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:03:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 56, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.133.122.57", "classifications": [], "first_seen": { "$date": "2023-03-13T16:49:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:40:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 140, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "147.182.169.252", "classifications": [], "first_seen": { "$date": "2023-03-13T16:49:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:38:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 50", "ET SCAN Potential SSH Scan" ], "sightings": 350, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "156.67.214.223", "classifications": [], "first_seen": { "$date": "2023-03-13T17:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:08:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 147, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.9.109.164", "classifications": [], "first_seen": { "$date": "2023-03-13T17:18:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T17:32:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 78" ], "sightings": 14, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.245.225.170", "classifications": [], "first_seen": { "$date": "2023-03-13T17:58:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:12:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 550, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "34.93.41.247", "classifications": [], "first_seen": { "$date": "2023-03-13T18:04:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:08:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 119, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "128.199.52.45", "classifications": [], "first_seen": { "$date": "2023-03-13T18:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:53:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 27", "ET SCAN Potential SSH Scan" ], "sightings": 308, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "198.199.109.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T18:02:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:02:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1874, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.151.226.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T18:12:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:13:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1872, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.181", "classifications": [ "Attempted Information Leak", "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T18:31:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:35:49Z" }, "ports": [ 53, 0, 22, 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 3134, "tags": [ "udp", "icmp", "tcp", "ssh", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "212.68.38.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T18:35:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:14:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40339, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.200.21.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T18:36:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:51:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7480, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.48", "classifications": [ "Misc activity", "Executable code was detected", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T18:45:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:34:32Z" }, "ports": [ 0, 22, 5632, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "APP-DETECT PCAnywhere server response", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 32484, "tags": [ "icmp", "tcp", "ssh", "udp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "118.193.72.69", "classifications": [], "first_seen": { "$date": "2023-03-13T18:55:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:55:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 934, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "171.244.60.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T19:03:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:22:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10256, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.181.112.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T19:05:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:16:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8392, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.48", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-13T19:11:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:42:02Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 3139, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "196.28.227.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T19:13:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:13:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.142.84.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T19:29:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:29:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.173.9.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T19:30:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T19:30:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1864, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.254.255.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T19:53:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:55:06Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 945, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "2.59.135.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T19:59:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:25:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8396, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.240.46.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T20:00:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:22:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 11295, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.99.134.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T20:02:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:13:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8352, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.25.98.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T20:02:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:18:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5565, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.104.126.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T20:05:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:51:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3646, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.89.122.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T20:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:59:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10167, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.135.219.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T20:19:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:36:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Host Unreachable" ], "sightings": 1858, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.4.250.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T20:31:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T00:50:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA TCPv4 invalid checksum" ], "sightings": 18605, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.115.79.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T20:34:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:49:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10155, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.97.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T20:36:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:12:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 138096, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.39.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T21:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:19:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3537, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.142.109.83", "classifications": [], "first_seen": { "$date": "2023-03-13T21:09:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:09:17Z" }, "ports": [ 88 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 1840, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "141.98.10.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T21:18:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:08:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5420, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.195.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T21:20:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:20:44Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2757, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.98.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T21:23:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:25:22Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2761, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "113.4.248.205", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T21:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:42:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 9255, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "201.123.139.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T21:40:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:15:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17393, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.36.108.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T21:41:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:18:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2760, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.109.191.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T21:42:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:28:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17267, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.93.63.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T21:42:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:54:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7331, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.224.128.239", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-13T21:47:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:08:02Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4405, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "78.138.17.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T21:58:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:28:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 10971, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.201.149.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T21:59:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:59:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 1837, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "61.2.224.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:02:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:13:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6401, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.17.195.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:03:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:40:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18250, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "81.95.124.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T22:11:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:11:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1828, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T22:15:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:15:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1828, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.195.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T22:15:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:15:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1828, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.181.228.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:16:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:07:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27208, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.70.175.9", "classifications": [], "first_seen": { "$date": "2023-03-13T22:18:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:18:08Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 1826, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.10.245.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:26:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:41:23Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 94", "ET SCAN Potential SSH Scan" ], "sightings": 8331, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "189.136.225.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T22:26:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:26:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1824, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.98.145.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:29:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:41:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 293919, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.144.43.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T22:33:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:37:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3594, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.67.36.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:35:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 911, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.100.226.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:36:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:51:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8159, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.175.235.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:36:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:14:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18075, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.204.144.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T22:36:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:36:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1822, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.110.1.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:37:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:51:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8156, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "131.147.183.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:37:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:50:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8160, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "66.70.129.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T22:41:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:41:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1818, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.30.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:42:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:57:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5423, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.166.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:43:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:56:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 5422, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.78.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:44:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:14:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18051, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "84.54.50.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T22:47:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:50:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14262, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.232.75.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:10:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:19:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11760, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.190.204.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:11:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:21:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7210, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.156.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:11:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:24:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9006, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.36.183.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:12:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:12:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 902, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.232.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T23:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:51:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1810, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.14.69.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T23:17:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:32:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3928, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.248.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T23:19:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:19:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1802, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.68.87.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:29:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:44:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8970, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.220.15.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:30:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:44:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6280, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.142.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:30:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:45:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9866, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.105.104.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:32:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:14:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26843, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.109.221", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-13T23:40:33Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:16:24Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 5998, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.130.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-13T23:44:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:44:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1792, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.3.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:47:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:01:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.95.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:48:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:58:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6260, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.75.23.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T00:09:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:09:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1786, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.83.190.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T00:12:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:17:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3322, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.142.151.37", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T00:13:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:07:40Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 10240, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "143.198.119.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T00:17:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:55:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1790, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.208.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T00:17:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:18:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4348, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.210.157.18", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-14T00:43:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:15:35Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6764, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "39.102.228.117", "classifications": [], "first_seen": { "$date": "2023-03-14T00:48:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:46:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 2068, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.248.190.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T00:49:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:07:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-ICMP PING BSDtype", "PROTOCOL-ICMP PING Unix", "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8873, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "107.170.232.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T00:50:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1782, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T00:58:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:58:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1778, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.86.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T01:08:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:56:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4438, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.52.250.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T01:13:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:13:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4440, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "34.239.148.127", "classifications": [], "first_seen": { "$date": "2023-03-14T01:17:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:17:11Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 888, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "81.95.131.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T01:18:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:19:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1776, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T01:19:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:22:57Z" }, "ports": [ 0, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 1789, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.214.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T01:28:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:59:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.75.6.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T01:28:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:28:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 6205, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "143.42.185.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T01:35:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:27:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3400, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.138.14.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T01:36:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:07:06Z" }, "ports": [ 1434, 0, 53 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS Malformed DNS query with HTTP content" ], "sightings": 22840, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "210.90.239.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T01:36:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:36:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1772, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.148.122.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T01:58:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T08:37:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.90.124.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T02:02:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:02:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1770, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.106.221.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T02:09:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:09:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1770, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.157.8.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:17:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:28:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7044, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.197.196.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:29:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7920, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.230.185.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T13:50:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 916, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.240.138.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:20:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1766, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "173.255.243.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T02:23:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:04:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2954, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.111.228.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:48:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:02:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5252, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.59.62.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:49:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:49:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1752, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.109.253.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:50:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:39:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26124, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.245.219.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:54:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:54:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1752, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.194.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:55:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:17:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14852, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.253.82.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:56:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:41:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 26969, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.108.204.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T03:05:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:05:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1750, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.156.96.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T03:05:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:23:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12193, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.92.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:09:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:09:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.58.98.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:13:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:37:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3350, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.76.116.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:20:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:35:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3468, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.179.253.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T03:29:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:29:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1732, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.228", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:32:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:32:35Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3576, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.238.7", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T03:33:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:05:55Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 1884, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.138.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:34:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:34:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1732, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.220.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:35:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:44:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3290, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.122.119.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T03:36:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:51:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12099, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.55.0.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:36:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:59:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1762, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.207.200.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:49:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:23:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 79524, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "199.195.251.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:51:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:09:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3450, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.3.115.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T03:51:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:52:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1726, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.46.60.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T03:52:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:52:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3452, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.36.169.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T03:53:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:53:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 863, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.18", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-03-14T04:21:33Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:48:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4850, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "121.191.199.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T04:39:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:39:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1722, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.52.51.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T04:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:47:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1722, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.3.66", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-14T04:52:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:39:22Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5139, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "183.238.63.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T05:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:06:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T05:14:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:27:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1720, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.120.176.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T05:16:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:30:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34997, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.175.221.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T05:17:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:31:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8562, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.3.211.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T05:17:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:30:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10277, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.240.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T05:21:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:09:16Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6000, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.139.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T05:21:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:21:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1714, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.162.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T05:22:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:44:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4270, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.92.118.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T05:49:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:03:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8516, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.167.216.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T05:50:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:35:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14822, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.117.11", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-03-14T06:04:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:23:22Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4851, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "109.74.193.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T06:15:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:33:00Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4943, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "212.129.63.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T06:26:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:40:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9313, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.44.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T06:30:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T19:23:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 9078, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.246.125.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T06:30:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:30:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 848, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.97.93.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T06:31:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:45:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6757, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.249.255.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T06:40:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:40:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.150.65.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T06:41:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:41:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1686, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.162.67.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T06:47:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:48:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1686, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.133.176.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T06:56:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:07:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5031, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.68.11.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T06:58:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:56:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6679, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.246.124.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T07:02:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:00:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8350, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.163.241.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T07:04:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:58:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 12524, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.100.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T07:14:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:42:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3234, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.116.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T07:18:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:20:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3500, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.229.3.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T07:21:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:42:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11674, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.137.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T07:28:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:53:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.126.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T07:35:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:14:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3084, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.90.19.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T07:37:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:37:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 833, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.139.83", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-14T08:02:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:51:17Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 4955, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "104.156.155.2", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T08:07:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:00:51Z" }, "ports": [ 5454, 56064, 161, 6664, 8554, 7000, 6001 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 35476, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.200.212.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T08:12:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:02:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14086, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.34.222.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T08:17:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:18:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1664, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.91.152.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T08:24:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:39:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6632, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.50.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T08:24:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:39:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 43" ], "sightings": 6637, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.32.194.96", "classifications": [], "first_seen": { "$date": "2023-03-14T08:45:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 827, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "170.187.157.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T08:50:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:05:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3292, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.71.82.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T08:50:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:52:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1654, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.206.140", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T08:51:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:53:51Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 15942, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "14.207.126.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T08:54:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:54:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4131, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "125.139.82.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T09:02:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:42:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1656, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.226.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T09:02:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:02:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1650, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T09:12:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:12:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.244.39.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T09:14:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:33:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9054, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "102.223.173.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T09:24:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:42:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6584, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.163.231.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T09:27:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:42:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8230, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "173.255.243.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T09:38:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:12:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2884, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.55.0.15", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T09:41:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:56:20Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2481, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "46.26.235.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T09:44:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:38:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22867, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.230.103.250", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T09:46:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:39:44Z" }, "ports": [ 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 825, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T09:55:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:19:06Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 1963, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "172.247.80.102", "classifications": [], "first_seen": { "$date": "2023-03-14T09:56:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:56:00Z" }, "ports": [ 61078 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 820, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "36.153.254.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T09:56:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:48:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2526, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.229.84.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T09:57:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:12:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6544, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.212.233.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T10:01:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:16:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4903, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.170.122.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T10:02:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:02:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1638, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.122.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T10:02:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:33:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4728, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.124.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T10:09:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:48:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5866, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.212.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T10:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:03:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.230.103.243", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T10:18:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:18:29Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 816, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.115.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T10:22:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:38:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15386, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.79.142.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T10:31:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:45:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6485, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.232.76.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T10:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:09:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15434, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.109.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T10:36:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:36:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1622, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.118.255.6", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-14T10:53:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:01:28Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4854, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.106.252.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T10:59:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:59:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1618, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.199.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T11:03:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T12:47:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2401, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.40.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:30:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:46:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8831, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.175.89.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:31:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:29:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24076, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.115.238.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:31:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:44:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5620, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.98.103.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T11:31:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:31:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3216, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.48.17.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:32:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:46:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8027, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.161.11.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:33:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 123084, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.64.106.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:45:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8027, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "85.214.48.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:34:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:18:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16813, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.175.18.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:40:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:52:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5606, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.245.80.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:42:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:54:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6405, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.99.88.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T11:51:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:16:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14337, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.248.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T11:57:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:57:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1600, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.93.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T11:58:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:39:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1822, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.244.144.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T12:00:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:06:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4084, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.235.10.3", "classifications": [], "first_seen": { "$date": "2023-03-14T12:08:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:08:55Z" }, "ports": [ 82 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 1600, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.94.138.64", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-14T12:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:14:05Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2400, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.98.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T12:19:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:19:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.108.129.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T12:27:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:27:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Time-To-Live Exceeded in Transit" ], "sightings": 1596, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.137.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T12:39:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:39:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1596, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.31.129.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T12:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:47:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1596, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "102.16.101.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T12:48:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:49:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1594, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T12:53:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:53:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1594, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.205.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T12:59:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:00:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1604, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.205.116.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T13:04:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20672, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.18.244.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T13:05:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:56:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5563, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.226.138.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T13:06:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:21:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7169, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.227.28.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T13:12:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:09:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 802, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "44.200.10.172", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T13:19:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:19:57Z" }, "ports": [ 139, 162, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 2386, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.244.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T13:23:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:13:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1612, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.114.238.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T13:26:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:56:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3112, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.50", "classifications": [], "first_seen": { "$date": "2023-03-14T13:27:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:27:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 795, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "173.255.243.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T13:27:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:04:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2844, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.87.204.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T13:32:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:10:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.163.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T13:41:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:51:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6352, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "31.145.142.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T13:46:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:28:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3194, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.75.127.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T13:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:59:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1584, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.65.227.176", "classifications": [], "first_seen": { "$date": "2023-03-13T18:14:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T18:45:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 24, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "160.155.128.115", "classifications": [], "first_seen": { "$date": "2023-03-13T19:41:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:38:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 63", "ET SCAN Potential SSH Scan" ], "sightings": 324, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "119.203.152.98", "classifications": [], "first_seen": { "$date": "2023-03-13T20:18:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:18:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "177.200.94.187", "classifications": [], "first_seen": { "$date": "2023-03-13T20:27:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:17:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 180, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "69.112.204.55", "classifications": [], "first_seen": { "$date": "2023-03-13T20:48:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T20:48:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.228.113.21", "classifications": [], "first_seen": { "$date": "2023-03-13T21:26:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T21:26:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "163.5.59.60", "classifications": [], "first_seen": { "$date": "2023-03-13T22:29:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:33:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 210, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "118.39.57.33", "classifications": [], "first_seen": { "$date": "2023-03-13T22:46:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T22:46:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "157.230.23.198", "classifications": [], "first_seen": { "$date": "2023-03-13T23:12:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-13T23:52:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 180, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "193.19.96.225", "classifications": [], "first_seen": { "$date": "2023-03-13T23:14:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:20:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 106" ], "sightings": 206, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.184.50.251", "classifications": [], "first_seen": { "$date": "2023-03-13T23:17:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:07:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 114", "ET SCAN Potential SSH Scan" ], "sightings": 300, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "13.72.86.172", "classifications": [], "first_seen": { "$date": "2023-03-13T23:19:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:23:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34", "ET SCAN Potential SSH Scan" ], "sightings": 283, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "94.179.133.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-13T23:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:01:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 188", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5611, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.126.34.211", "classifications": [], "first_seen": { "$date": "2023-03-14T00:00:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:48:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 91", "ET SCAN Potential SSH Scan" ], "sightings": 267, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "186.147.232.149", "classifications": [], "first_seen": { "$date": "2023-03-14T00:00:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:59:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 67, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "27.147.157.237", "classifications": [], "first_seen": { "$date": "2023-03-14T00:04:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:03:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 135", "ET SCAN Potential SSH Scan" ], "sightings": 210, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "150.230.87.21", "classifications": [], "first_seen": { "$date": "2023-03-14T00:04:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:23:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 51" ], "sightings": 166, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "212.70.149.130", "classifications": [], "first_seen": { "$date": "2023-03-14T00:30:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T00:30:27Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 5, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.245.106.55", "classifications": [], "first_seen": { "$date": "2023-03-14T01:12:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:12:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 127" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.153.203.84", "classifications": [], "first_seen": { "$date": "2023-03-14T01:27:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:27:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 25, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.163.125.213", "classifications": [], "first_seen": { "$date": "2023-03-14T01:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:43:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "96.18.197.132", "classifications": [], "first_seen": { "$date": "2023-03-14T01:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T01:44:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "164.163.98.49", "classifications": [], "first_seen": { "$date": "2023-03-14T02:12:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:12:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 67", "ET 3CORESec Poor Reputation IP group 16" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "13.90.86.194", "classifications": [], "first_seen": { "$date": "2023-03-14T02:17:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:17:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.153.64.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:27:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:33:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 370, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.249.173.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T02:28:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:23:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6482, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.77.105.98", "classifications": [], "first_seen": { "$date": "2023-03-14T02:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:21:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 150, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "69.49.235.162", "classifications": [], "first_seen": { "$date": "2023-03-14T02:30:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T02:30:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 176" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.45.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T03:09:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:22:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 27", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 282, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "110.136.219.175", "classifications": [], "first_seen": { "$date": "2023-03-14T03:14:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:53:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 95, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "164.77.117.10", "classifications": [], "first_seen": { "$date": "2023-03-14T03:18:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T03:54:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 67", "ET SCAN Potential SSH Scan" ], "sightings": 175, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "112.196.9.84", "classifications": [], "first_seen": { "$date": "2023-03-14T04:06:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T22:12:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 538, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.59.186.75", "classifications": [], "first_seen": { "$date": "2023-03-14T04:07:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:35:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 80, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.198.120.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T04:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:50:00Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18893, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.73.29.37", "classifications": [], "first_seen": { "$date": "2023-03-14T04:46:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T04:46:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "213.142.151.65", "classifications": [], "first_seen": { "$date": "2023-03-14T05:02:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:06:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 365, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "211.109.181.11", "classifications": [], "first_seen": { "$date": "2023-03-14T05:05:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:05:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "96.224.11.240", "classifications": [], "first_seen": { "$date": "2023-03-14T05:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:14:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 35, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.248.163.75", "classifications": [], "first_seen": { "$date": "2023-03-14T05:14:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:14:38Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 5, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "158.160.17.133", "classifications": [], "first_seen": { "$date": "2023-03-14T05:37:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:47:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 20, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.58.117.15", "classifications": [], "first_seen": { "$date": "2023-03-14T05:39:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:11:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 70, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "81.22.233.170", "classifications": [], "first_seen": { "$date": "2023-03-14T05:40:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:11:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 180", "ET 3CORESec Poor Reputation IP group 44", "ET SCAN Potential SSH Scan" ], "sightings": 180, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "218.255.245.10", "classifications": [], "first_seen": { "$date": "2023-03-14T05:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:12:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 30", "ET SCAN Potential SSH Scan" ], "sightings": 70, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.191.141.152", "classifications": [], "first_seen": { "$date": "2023-03-14T05:45:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T05:57:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "93.46.120.42", "classifications": [], "first_seen": { "$date": "2023-03-14T06:08:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:09:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 88" ], "sightings": 15, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "164.163.68.248", "classifications": [], "first_seen": { "$date": "2023-03-14T06:29:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:45:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 45, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "35.207.124.57", "classifications": [], "first_seen": { "$date": "2023-03-14T06:30:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:23:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 85, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.230.220.12", "classifications": [], "first_seen": { "$date": "2023-03-14T06:30:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:17:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 100, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "101.51.91.219", "classifications": [], "first_seen": { "$date": "2023-03-14T06:47:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:48:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "116.177.233.76", "classifications": [], "first_seen": { "$date": "2023-03-14T06:57:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T06:57:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.80.57", "classifications": [], "first_seen": { "$date": "2023-03-14T07:00:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T07:48:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 66", "ET 3CORESec Poor Reputation IP group 16", "ET SCAN Potential SSH Scan" ], "sightings": 250, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "157.230.57.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T07:21:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:27:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1460, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.49.17", "classifications": [], "first_seen": { "$date": "2023-03-14T08:43:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:14:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.232.164.156", "classifications": [], "first_seen": { "$date": "2023-03-14T08:44:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:16:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.91.168.130", "classifications": [], "first_seen": { "$date": "2023-03-14T08:55:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T08:55:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "5.255.104.74", "classifications": [], "first_seen": { "$date": "2023-03-14T09:00:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:28:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 64, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.27.178.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T09:04:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:22:21Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "196.196.253.2", "classifications": [], "first_seen": { "$date": "2023-03-14T09:05:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:36:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 109", "ET SCAN Potential SSH Scan" ], "sightings": 140, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "128.199.0.216", "classifications": [], "first_seen": { "$date": "2023-03-14T09:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T09:47:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.248.133.34", "classifications": [], "first_seen": { "$date": "2023-03-14T09:56:08Z" }, "ja3": [ "35fa0a83e466acbec1cfbb9016d550ab" ], "last_seen": { "$date": "2023-03-14T09:56:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh", "anomaly", "tls" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "144.34.212.238", "classifications": [], "first_seen": { "$date": "2023-03-14T09:58:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:03:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 47" ], "sightings": 140, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.204.87.65", "classifications": [], "first_seen": { "$date": "2023-03-14T09:58:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:03:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 224, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "68.183.105.114", "classifications": [], "first_seen": { "$date": "2023-03-14T09:59:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:46:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174", "ET 3CORESec Poor Reputation IP group 42", "ET SCAN Potential SSH Scan" ], "sightings": 204, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "182.23.63.19", "classifications": [], "first_seen": { "$date": "2023-03-14T09:59:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:55:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 89", "ET SCAN Potential SSH Scan" ], "sightings": 196, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "123.31.29.192", "classifications": [], "first_seen": { "$date": "2023-03-14T10:02:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:02:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 23" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.224.63.169", "classifications": [], "first_seen": { "$date": "2023-03-14T10:10:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:10:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "203.177.91.202", "classifications": [], "first_seen": { "$date": "2023-03-14T10:16:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:16:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 120" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "178.128.122.196", "classifications": [], "first_seen": { "$date": "2023-03-14T10:16:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:54:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 52, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.43.192", "classifications": [], "first_seen": { "$date": "2023-03-14T10:16:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:16:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62", "ET 3CORESec Poor Reputation IP group 16" ], "sightings": 8, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "138.197.175.169", "classifications": [], "first_seen": { "$date": "2023-03-14T10:18:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T10:47:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35", "ET SCAN Potential SSH Scan" ], "sightings": 140, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "36.139.110.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T11:41:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:26:10Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.248.254.162", "classifications": [], "first_seen": { "$date": "2023-03-14T11:53:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T11:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "42.51.33.18", "classifications": [], "first_seen": { "$date": "2023-03-14T12:07:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:12:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 40, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "117.251.85.118", "classifications": [], "first_seen": { "$date": "2023-03-14T12:49:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T12:52:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 44, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "50.73.38.178", "classifications": [], "first_seen": { "$date": "2023-03-14T13:50:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:50:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 16, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.222.181.24", "classifications": [], "first_seen": { "$date": "2023-03-14T13:55:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:55:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 104, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "89.33.164.23", "classifications": [], "first_seen": { "$date": "2023-03-14T13:59:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T13:59:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 86" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.59.231.14", "classifications": [], "first_seen": { "$date": "2023-03-14T14:04:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:47:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 38" ], "sightings": 89, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.206.231.221", "classifications": [], "first_seen": { "$date": "2023-03-14T14:05:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:30:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 34, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.172.159.73", "classifications": [], "first_seen": { "$date": "2023-03-14T14:07:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:07:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 74" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.159.46.253", "classifications": [], "first_seen": { "$date": "2023-03-14T14:07:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:37:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 52, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.1.72.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T14:05:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:50:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2484, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.61.10.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T14:09:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:09:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1582, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.3.20.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T14:12:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:12:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1582, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "207.154.230.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T14:15:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:31:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8677, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.25.199.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T14:19:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:19:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1578, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.112.48.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T14:30:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:30:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 788, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.121.122.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T14:31:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:44:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 6304, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.177.198.104", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-03-14T14:34:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:08:34Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4686, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "122.233.254.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T14:34:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T14:34:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.204.65.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T14:35:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:15:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window", "(stream_tcp) SYN on established session" ], "sightings": 11014, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.134.231.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T14:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:27:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6015, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.99.98.140", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T14:49:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:20:58Z" }, "ports": [ 1900, 0, 161, 1434 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "SQL ping attempt" ], "sightings": 138961, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "185.89.22.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:00:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:07:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2346, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.57.15.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:00:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:14:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 786, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.28.218.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T15:02:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:02:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1568, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.42.229.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T15:02:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:30:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2972, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.177.99.119", "classifications": [], "first_seen": { "$date": "2023-03-14T15:03:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:03:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 782, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "41.63.1.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:03:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:18:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 7030, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.68.225.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:04:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:20:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 37267, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.116.6.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T15:05:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:05:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1562, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.200.58.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:09:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:10:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1562, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.4.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T15:18:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:37:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.3.127.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:41:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:58:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3885, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.68.175.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:43:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:59:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8541, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.243.242.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:44:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:59:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is missing" ], "sightings": 16307, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.55.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:45:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:53:21Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12737, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.53.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:46:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:24:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21682, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.224.86.128", "classifications": [], "first_seen": { "$date": "2023-03-14T15:50:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T20:10:42Z" }, "ports": [ 80, 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 786, "tags": [ "tcp", "http", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "82.151.192.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T15:51:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:10:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9293, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.7.1.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T16:09:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:09:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1548, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.39", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T17:14:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:07:36Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 19657, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "139.59.175.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T17:17:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:32:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7662, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.211.171.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T17:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:48:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6143, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.114.133.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T17:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:20:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.132.41.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T17:21:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:21:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.68.85.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T17:44:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:04:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2721, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.115.76.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T18:07:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:07:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.109.170.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T18:14:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:26:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6868, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.125.222.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T18:15:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:12:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5888, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.110.249.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T18:15:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:27:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11446, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "74.208.93.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T18:16:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:25:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6867, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.68.134.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T18:16:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:14:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9581, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T18:17:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:17:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1526, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.254.237.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T18:19:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:19:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1526, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.69.234.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T18:34:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:34:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1526, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.140.181.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T18:35:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:06:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3642, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.173.221.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T18:42:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:42:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1526, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.144.56.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T18:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:41:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 3304, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.117.126.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T18:53:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:22:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1001017, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.177.198.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T18:59:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:33:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3040, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.231.151.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T19:05:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:05:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1522, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.121.115", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T19:16:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:36:53Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 18907, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "81.28.6.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T19:31:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:23:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7657, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.184.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T19:32:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:57:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9686, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.69.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T19:34:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:48:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9100, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T19:37:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:18:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20312, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.220.129.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T19:54:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:20:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.171.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:01:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:10:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4541, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.50.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:02:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:13:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5296, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.99.149.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:02:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:52:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6079, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.3.100.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:56:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16481, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.23.149.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:10:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:23:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8306, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.236.153.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T20:12:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:12:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.201.181.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T20:18:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:39:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7542, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.173.83.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T20:22:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:42:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3002, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.222.117.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:23:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:38:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6007, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.137.124.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:24:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:24:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 755, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.36.250.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:25:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:39:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8250, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.103.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:26:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:37:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7507, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.84.236.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:26:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:01:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14950, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.68.90.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T20:41:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:04:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3414, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.234.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T20:55:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:55:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1492, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.175", "classifications": [ "Executable code was detected", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-14T21:12:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:58:09Z" }, "ports": [ 22, 0, 53 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 2704, "tags": [ "tcp", "ssh", "icmp", "udp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "198.199.101.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T21:23:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:23:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1492, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.222.130.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T21:27:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:27:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1490, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.196.138.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:42:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:55:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8178, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.85.39.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:20:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22144, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.92.71.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:57:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8172, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.119.212.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:44:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:41:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16456, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.137.20.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:44:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:44:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 748, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "173.82.163.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:47:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:57:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5195, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.203.191.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:53:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:14:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7366, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "173.160.23.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:53:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:10:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5163, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.3.255.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:54:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:13:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13084, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.90.246.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:11:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:11:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "SURICATA Applayer Wrong direction first Data", "APPLAYER_WRONG_DIRECTION_FIRST_DATA" ], "sightings": 747, "tags": [ "tcp", "ssh", "alert", "anomaly", "http" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "151.74.56.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T22:21:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:11:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1988, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.161.200.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:25:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:54:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10735, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.177.182.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:25:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:50:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7261, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.81.9.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:26:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:39:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6554, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.144.158.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:28:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:44:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7271, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "50.110.107.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:29:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:21:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 17335, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.129.225.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:29:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:43:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26647, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.254.37.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T22:34:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:34:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1454, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.49.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:35:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:33:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58071, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.173.48.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:35:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:35:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1454, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.210.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T22:42:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:35:05Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2183, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.134.13", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-14T22:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:52:13Z" }, "ports": [ 5060, 0, 1900 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 2199, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "122.116.212.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:33:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:33:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1436, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.92.24.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:34:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:49:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5716, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "15.235.202.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:35:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:28:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16676, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.179.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:35:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:51:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9276, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.232.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:36:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:27:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 146973, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.157.23.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:36:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:52:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7850, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.93.220.21", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:41:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:04:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply" ], "sightings": 9799, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "168.138.163.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:42:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:42:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "96.9.226.15", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:42:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:42:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 14342, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "193.37.215.137", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:43:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 17899, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "104.223.19.105", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 8912, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "69.61.31.230", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:43:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7140, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "45.32.147.183", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 24960, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "185.99.254.243", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 16920, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "172.93.218.175", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 19569, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "45.32.200.15", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 8910, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "140.82.57.12", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 18675, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "62.113.202.75", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:44:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 17850, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.221.192.30", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:44:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:44:48Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2856, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.221.192.26", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:44:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:44:48Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2856, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.221.192.27", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:44:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:44:48Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2856, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.93.189.118", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:46:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:46:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17824, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "172.93.222.152", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:47:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:47:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 7115, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "23.140.99.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:56:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:11:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6372, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.112.75.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-14T23:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:06:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28261, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.206.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:06:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:48:53Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 1426, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.103.199", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-15T00:14:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:13:20Z" }, "ports": [ 0, 53 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 1422, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.227.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:17:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:17:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1416, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.214.243.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:22:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:42:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.21.123.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T00:43:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:56:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6363, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.151.125.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:47:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:47:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1414, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:50:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:06:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2126, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.75.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T00:50:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:04:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 68" ], "sightings": 7778, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.43.64.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T00:51:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:02:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5656, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.223.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:51:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:51:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1414, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.99.196.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:53:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:02:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1910, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.237.150.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:58:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:58:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3535, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "167.71.110.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T00:58:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:58:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1414, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.18.141.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T01:04:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:04:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1412, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.255.245.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:18:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:18:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 705, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.116.21.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:18:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:35:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7040, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "86.1.242.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:19:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:35:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 9857, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.54.105.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:19:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:36:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6335, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "150.136.32.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:20:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:38:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9149, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.232.96.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:20:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:38:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7745, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.250.248.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:21:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:21:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 705, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.185.0.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:22:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:33:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4224, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "160.20.165.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:23:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:59:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14058, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "88.80.189.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T01:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:38:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2804, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "132.145.46.98", "classifications": [], "first_seen": { "$date": "2023-03-15T01:55:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:11:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 1502, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.67.63.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T01:55:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:55:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3510, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "121.149.201.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:57:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:58:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1404, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T01:59:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:13:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.133.104.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T02:01:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:01:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1402, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "63.41.9.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T02:10:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:10:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9004, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.142.152.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T02:14:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:59:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20963, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.226.98.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T02:22:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:22:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1398, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.111.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T02:49:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:24:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2581, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.149.109.137", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T03:01:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:01:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10255, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.253.76.36", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T03:01:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 203098, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.250.86.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T03:22:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:05:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 9222, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.81.211.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T03:23:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:38:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6559, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.106.36.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T03:29:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:29:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 656, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.105.153.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T03:43:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:11:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2504, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T03:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:48:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2426, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.42.84.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:08:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:08:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1306, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.185.51.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:18:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:05:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.229.10.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T04:21:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:33:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5213, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.229.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T04:23:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:30:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1955, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.216.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:24:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:24:50Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1956, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.96.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:30:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:30:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.237.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:31:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:51:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2134, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.224.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:31:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:31:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.228.150.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T04:33:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:05:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11361, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.39.133.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T04:35:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:47:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5200, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.39.122.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:42:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:42:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1300, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:43:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:34:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1308, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.21.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T04:47:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:47:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1300, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:53:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:53:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1300, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:57:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:45:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2188, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T04:57:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:35:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2888, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T05:17:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:16:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1310, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.33.179.175", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-15T05:25:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:56:17Z" }, "ports": [ 0, 161, 1900, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "SQL ping attempt" ], "sightings": 48291, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "107.189.12.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T05:32:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T05:32:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1298, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.207.200.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T05:40:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:08:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 71810, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.111.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T05:46:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T05:46:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1294, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.39.122.195", "classifications": [ "Detection of a Network Scan", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-15T05:52:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:43:31Z" }, "ports": [ 1900, 0, 1434, 161 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 60791, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "158.160.54.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T06:06:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:20:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 10307, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.211.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T06:07:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:19:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6443, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.232.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T06:07:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:19:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5155, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.63.212.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T06:07:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:19:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4511, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.14.141.36", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T06:07:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:07:58Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2588, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "128.14.141.38", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T06:07:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:07:58Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2588, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "128.14.141.37", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T06:07:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:07:58Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2584, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "189.8.68.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T06:09:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:22:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5798, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.35.18.112", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-15T06:12:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:45:05Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6235, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.81.243.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T06:15:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:07:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15994, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.27.45.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T06:31:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:32:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1288, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.69.217.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T06:37:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:24:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2476, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T06:51:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:24:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1298, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.254.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T07:03:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:13:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2346, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.124.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T07:06:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:20:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5777, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.224.128.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T07:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:46:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3228, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.25.118.136", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T07:07:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:22:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7700, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "70.166.97.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T07:32:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:32:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1280, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.125.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T07:49:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:26:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18526, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.106.227.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T07:51:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:08:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4475, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.203.150.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T07:52:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:54:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19090, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.209.4.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T07:52:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:07:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5115, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.66", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-15T07:58:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:16:49Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 1935, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "180.122.214.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T08:02:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:02:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3195, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "195.19.96.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:05:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:21:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5750, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.103.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:59:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11566, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.247.213.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:07:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:28:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2549, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.69.183.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:07:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:03:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19025, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.184.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:08:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:21:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6389, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.169.66.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T08:09:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:27:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2182, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.87.67.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T08:09:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:09:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1278, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.107.189.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:11:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:28:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6379, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.97.195.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:27:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5741, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "66.212.133.130", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T08:17:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:17:53Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7668, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "157.122.75.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T08:20:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:20:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3191, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "114.35.88.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:21:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:21:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1276, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.184.97.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:28:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:28:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1272, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.78.201.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:35:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:46:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 183" ], "sightings": 5701, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.2.170.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:37:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:37:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1272, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.208.214.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T08:43:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:04:48Z" }, "ports": [ 0, 1434, 7001 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "POLICY-OTHER AFS access" ], "sightings": 10075, "tags": [ "icmp", "udp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "38.60.204.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:48:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:04:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6293, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "120.89.98.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:49:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:14:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8603, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.236.75.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:54:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:10:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8160, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "75.149.214.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T08:57:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:58:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1258, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.22.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:00:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:00:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1258, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.69.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T09:08:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:11:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.174.34.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:10:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:26:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6232, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.67.248.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:14:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:30:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4983, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "102.222.160.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:16:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:13:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8584, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "80.87.33.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:29:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:45:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6212, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "73.15.203.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:30:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:10:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 19273, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.151.215.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:33:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:45:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4968, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.208.85.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:33:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:50:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6208, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.159.114.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:34:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:43:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4347, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.131.68.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:45:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:45:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 621, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "150.239.169.217", "classifications": [], "first_seen": { "$date": "2023-03-15T09:51:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:51:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 620, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.101.225.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:52:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:07:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4339, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.205.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:03:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:03:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(ssh) payload size incorrect for the given payload" ], "sightings": 1860, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "180.243.7.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T10:06:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:06:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1240, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.36.88.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T10:07:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:56:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2474, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.18.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:08:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:28:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6809, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.107.244.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:27:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4952, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.35.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:39:45Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5622, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "174.138.40.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T10:09:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:51:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "136.144.49.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T10:15:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:15:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1238, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.230.32.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T10:18:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:57:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3105, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "189.204.156.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:36:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:51:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5566, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.105.153.185", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-15T10:39:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:21:41Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4944, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "165.227.2.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:40:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:51:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5565, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.226.138.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:40:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:52:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4329, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "144.24.73.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T10:41:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:41:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1238, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.99.202.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:42:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:45:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18519, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.142.82.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:43:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:01:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6798, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.242.86.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:43:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:02:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6798, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.228.10.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:45:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:46:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1236, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.225.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T10:46:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:23:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17903, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.16.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T10:54:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:56:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.232.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T11:03:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:03:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1234, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.32.202.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T11:09:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:20:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1234, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.32.78.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T11:13:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:13:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1234, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.195.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T11:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:34:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.11.214.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T12:15:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:42:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3306, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.157.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T12:17:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:48:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1250, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.192.232.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T12:21:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:46:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1698, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.50.24.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T12:22:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:43:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3697, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "98.42.119.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T12:23:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:23:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1233, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.82.182.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:07:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:23:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6131, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.143.27.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:07:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:03:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18349, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.56.152.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:09:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:25:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3679, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.79.175.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T13:15:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:14:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2412, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.182.96.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:23:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:39:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4285, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T13:24:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:21:37Z" }, "ports": [ 80, 0 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1549, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "8.222.148.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:24:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:38:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1835, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.89.46.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:25:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:44:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6729, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.82.96.133", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:25:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:54:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18572, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.218.164.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:26:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:16:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7531, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "102.128.78.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:29:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:40:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3669, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.22.204.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:30:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:35:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10613, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.79.143.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T13:53:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:21:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2432, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.192.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:07:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:26:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7878, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.102.174.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:07:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:27:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6059, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.215.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:07:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:51:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6229, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.200.197.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:08:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:28:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7271, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.68.136.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:08:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:56:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6664, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.68.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:09:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T01:45:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5526, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "52.55.83.221", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-15T14:09:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:10:05Z" }, "ports": [ 3306, 2003, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 2434, "tags": [ "tcp", "mysql", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "167.71.95.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:10:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:21:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5455, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "44.203.109.115", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-15T14:11:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:11:15Z" }, "ports": [ 162, 161, 10010 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp", "(port_scan) TCP portscan" ], "sightings": 1824, "tags": [ "tcp", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "117.22.253.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T14:20:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:20:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1210, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "70.54.182.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:38:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6043, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.87.112.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T14:39:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:39:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1210, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.152.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T14:46:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:55:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3624, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.104.121.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T15:05:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:31:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2384, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.118.176.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:07:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:08:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1208, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.75.150.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:10:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:26:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6633, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.61.137.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:15:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:56:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18016, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.79.142.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:18:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:33:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4211, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.209.8.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:19:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:34:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6016, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.143.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:21:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:38:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6615, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.66.217.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:23:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:17:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17370, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.37.173.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:24:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:38:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4206, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.53.175.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:26:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:14:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8037, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "77.82.90.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:30:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:45:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1801, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.149.7.125", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-15T15:40:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:20:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 6015, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "35.201.147.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:40:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:21:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13155, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.194.252.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:41:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:02:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6585, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.178.53.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T15:46:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:50:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 4187, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "27.109.172.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T15:48:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:48:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.118", "classifications": [], "first_seen": { "$date": "2023-03-15T15:51:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:20:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 601, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "178.32.10.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T16:05:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:14:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4779, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.230.90.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T16:34:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:35:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1194, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.216.223.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T16:34:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:34:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1194, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.189.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T16:45:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:56:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2268, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.50.164.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T17:10:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:58:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1194, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.47.180.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T17:27:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:27:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1188, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.116.14.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T17:32:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:47:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5931, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.83.122.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T17:34:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:41:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.147.62.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T17:48:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:48:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1186, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.182.3.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T17:51:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:51:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.19.9.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T17:54:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:54:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 593, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.89.106.169", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-03-15T17:58:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:05:01Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 5192, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.185.113.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T18:04:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:13:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3524, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.78.127.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T18:08:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:08:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.158.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:11:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:27:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5326, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.161.235.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:13:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:30:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7095, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.54.107.223", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:28:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5324, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.110.58.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:15:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:27:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5920, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.126.176.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:16:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:39:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12032, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.129.8.235", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-15T18:17:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:13:04Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15680, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "75.51.10.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:18:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:31:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6495, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.56.96.163", "classifications": [], "first_seen": { "$date": "2023-03-15T18:20:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:58:08Z" }, "ports": [ 3306, 8080, 9000, 5001, 8008 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1188, "tags": [ "tcp", "mysql", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.134.168.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:22:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:22:32Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1234, "tags": [ "tcp", "brute_force", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.87.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:37:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:49:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4691, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.119.79.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:53:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:45:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17493, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.63.162.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:54:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:05:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4099, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.205.124.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:54:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T07:55:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 590, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.119.86.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:55:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:10:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5850, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.230.55.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:56:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:07:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5855, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.164.148.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:59:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:00:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1172, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.17.89.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:00:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:19:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6420, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "80.251.216.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:01:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:15:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4670, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.93.16.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T19:04:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:22:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30948, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.15.171.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:15:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5253, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.105.247.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:05:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:21:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6998, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.45.145.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:38:02Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7571, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "86.98.55.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:07:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:52:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16293, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.105.208.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:07:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:25:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7577, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "96.45.167.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:08:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:22:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5830, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.107.178.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:08:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:23:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6995, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "15.207.196.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:10:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:29:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19116, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.19.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:10:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:37:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4694, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.158.221.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:11:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:11:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 583, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.227.240.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T19:13:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:13:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.107.203.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:23:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:23:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.41.176.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T19:24:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:24:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1164, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "133.130.101.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:27:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:39:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4656, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "76.217.124.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T19:32:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:32:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1164, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.33.79.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T19:37:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:09:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2300, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.140.198.68", "classifications": [], "first_seen": { "$date": "2023-03-15T19:38:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:38:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 582, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "115.201.36.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T19:57:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:57:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.185.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T20:12:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:25:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5193, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.196.141.199", "classifications": [], "first_seen": { "$date": "2023-03-15T20:12:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T14:41:01Z" }, "ports": [ 49716, 30105, 33499 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP PDU missing ack for established session", "(tcp) TCP urgent pointer exceeds payload length or no payload" ], "sightings": 1182, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "77.222.243.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T20:49:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:49:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.105.163.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T20:52:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:52:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.153.235", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-15T21:07:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:07:12Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 576, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.111.17.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T21:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:15:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.235.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T21:30:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:29:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2224, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.109.52.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T21:32:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T22:17:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17223, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.131.253.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T21:32:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:02:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14832, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.253.39.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T21:35:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:49:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5170, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.118.57.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T22:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T22:55:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5142, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.56.25.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T22:39:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T22:50:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4003, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "174.164.140.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:01:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:02:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1138, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.68.97.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:04:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:14:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3978, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.92.165.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:43:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 10473, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.50.208.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:06:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:15:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5682, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "197.5.145.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:06:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:17:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 25" ], "sightings": 5110, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.154.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:07:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:16:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3974, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.124.174.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:09:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:55:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6208, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.184.238", "classifications": [], "first_seen": { "$date": "2023-03-14T14:52:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:08:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 27, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.217.131.242", "classifications": [], "first_seen": { "$date": "2023-03-14T15:28:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:32:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 120, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "80.181.53.248", "classifications": [], "first_seen": { "$date": "2023-03-14T15:48:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:30:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 87, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "39.129.54.66", "classifications": [], "first_seen": { "$date": "2023-03-14T15:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T15:54:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.16.132.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T16:00:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:19:42Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 112", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5303, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.207.89.44", "classifications": [], "first_seen": { "$date": "2023-03-14T16:02:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:49:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.46.191.166", "classifications": [], "first_seen": { "$date": "2023-03-14T16:03:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:08:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 219, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "79.148.99.217", "classifications": [], "first_seen": { "$date": "2023-03-14T16:04:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:45:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 90, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "88.83.209.230", "classifications": [], "first_seen": { "$date": "2023-03-14T16:05:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:54:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.225.159.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T16:22:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:13:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.186.102.230", "classifications": [], "first_seen": { "$date": "2023-03-14T16:26:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:07:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 90, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.62.145.43", "classifications": [], "first_seen": { "$date": "2023-03-14T16:27:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:44:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 24, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.248.133.190", "classifications": [], "first_seen": { "$date": "2023-03-14T16:37:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T16:37:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "47.99.152.7", "classifications": [], "first_seen": { "$date": "2023-03-14T17:19:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:22:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 60, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "120.71.146.132", "classifications": [], "first_seen": { "$date": "2023-03-14T17:30:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:35:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 210, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "202.21.121.210", "classifications": [], "first_seen": { "$date": "2023-03-14T17:41:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:35:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 66, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.248.131.9", "classifications": [], "first_seen": { "$date": "2023-03-14T17:44:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:34:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "ET SCAN Potential SSH Scan" ], "sightings": 147, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "135.125.202.29", "classifications": [], "first_seen": { "$date": "2023-03-14T17:47:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T17:47:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 32" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "101.36.104.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T17:48:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:42:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 1", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 158, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.106.213.198", "classifications": [], "first_seen": { "$date": "2023-03-14T18:38:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T18:39:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 15, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.82.122.102", "classifications": [], "first_seen": { "$date": "2023-03-14T19:12:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:17:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 201, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "177.87.144.26", "classifications": [], "first_seen": { "$date": "2023-03-14T19:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:12:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 39, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.31.71.51", "classifications": [], "first_seen": { "$date": "2023-03-14T19:40:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T19:42:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 18, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "219.249.140.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T20:00:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:15:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 131", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 51352, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.192.25", "classifications": [], "first_seen": { "$date": "2023-03-14T20:03:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:44:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 90, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.131.31.25", "classifications": [], "first_seen": { "$date": "2023-03-14T20:03:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:03:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 145" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.167.93.56", "classifications": [], "first_seen": { "$date": "2023-03-14T20:04:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:04:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "202.157.189.179", "classifications": [], "first_seen": { "$date": "2023-03-14T20:17:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:32:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "164.155.134.156", "classifications": [], "first_seen": { "$date": "2023-03-14T20:22:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:26:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Spamhaus DROP Listed Traffic Inbound group 15", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 15, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "77.69.171.43", "classifications": [], "first_seen": { "$date": "2023-03-14T20:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T20:50:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "109.192.216.13", "classifications": [], "first_seen": { "$date": "2023-03-14T21:04:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:46:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 96, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "213.230.124.230", "classifications": [], "first_seen": { "$date": "2023-03-14T21:08:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:08:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 129" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.110.43.205", "classifications": [], "first_seen": { "$date": "2023-03-14T21:09:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:11:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 400, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert", "anomaly" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "103.110.43.206", "classifications": [], "first_seen": { "$date": "2023-03-14T21:22:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:22:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.110.43.193", "classifications": [], "first_seen": { "$date": "2023-03-14T21:26:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:02:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "170.80.71.113", "classifications": [], "first_seen": { "$date": "2023-03-14T21:26:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:26:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 104, "tags": [ "ssh", "tcp", "ssh", "ssh", "alert", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "45.127.88.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T21:37:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:26:45Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 156", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 5060, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "219.78.72.195", "classifications": [], "first_seen": { "$date": "2023-03-14T21:37:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:10:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 51, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "161.35.208.99", "classifications": [], "first_seen": { "$date": "2023-03-14T21:39:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:07:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 48, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.89.164.89", "classifications": [], "first_seen": { "$date": "2023-03-14T21:39:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:07:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 48, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "46.245.80.28", "classifications": [], "first_seen": { "$date": "2023-03-14T21:40:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:13:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 51, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.110.43.207", "classifications": [], "first_seen": { "$date": "2023-03-14T21:41:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T21:47:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.110.43.195", "classifications": [], "first_seen": { "$date": "2023-03-14T21:45:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:00:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 14, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "181.29.63.127", "classifications": [], "first_seen": { "$date": "2023-03-14T22:47:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:01:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 24, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.172.85.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:49:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 74", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 247, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.131.41.251", "classifications": [], "first_seen": { "$date": "2023-03-14T22:49:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T22:49:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 145" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.33.254.154", "classifications": [], "first_seen": { "$date": "2023-03-14T22:49:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:43:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17", "ET SCAN Potential SSH Scan" ], "sightings": 159, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.153.100.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T22:50:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:03:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 148", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 84, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.128.241.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:02:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:13:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.149.67.251", "classifications": [], "first_seen": { "$date": "2023-03-14T23:03:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:55:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 69, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "144.48.240.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:06:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T02:47:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA STREAM excessive retransmissions", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 114, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "43.130.56.249", "classifications": [], "first_seen": { "$date": "2023-03-14T23:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:51:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 145", "ET SCAN Potential SSH Scan" ], "sightings": 153, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "18.205.56.137", "classifications": [], "first_seen": { "$date": "2023-03-14T23:10:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:10:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.187.33.125", "classifications": [], "first_seen": { "$date": "2023-03-14T23:27:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:27:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 78", "ET 3CORESec Poor Reputation IP group 43" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.243.233.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-14T23:29:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:07:08Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 66", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6014, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "104.28.228.78", "classifications": [], "first_seen": { "$date": "2023-03-14T23:30:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:00:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM CLOSEWAIT FIN out of window" ], "sightings": 24, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.28.196.78", "classifications": [], "first_seen": { "$date": "2023-03-14T23:41:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:03:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 27, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.29.70.126", "classifications": [], "first_seen": { "$date": "2023-03-14T23:59:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-14T23:59:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.12.254.140", "classifications": [], "first_seen": { "$date": "2023-03-15T00:04:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:04:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 48" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.28.196.77", "classifications": [], "first_seen": { "$date": "2023-03-15T00:09:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:47:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 15, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "91.144.20.198", "classifications": [], "first_seen": { "$date": "2023-03-15T00:17:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:17:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 186" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.198.61.187", "classifications": [], "first_seen": { "$date": "2023-03-15T00:18:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:47:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 45, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.28.228.77", "classifications": [], "first_seen": { "$date": "2023-03-15T00:28:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:38:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "94.41.61.59", "classifications": [], "first_seen": { "$date": "2023-03-15T00:40:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:40:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 90" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "136.49.106.190", "classifications": [], "first_seen": { "$date": "2023-03-15T00:53:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T00:53:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.237.228.220", "classifications": [], "first_seen": { "$date": "2023-03-15T01:22:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:11:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.20.209.253", "classifications": [], "first_seen": { "$date": "2023-03-15T01:22:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:20:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 157", "ET SCAN Potential SSH Scan" ], "sightings": 141, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "205.210.31.174", "classifications": [], "first_seen": { "$date": "2023-03-15T01:37:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:37:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.158.175.97", "classifications": [], "first_seen": { "$date": "2023-03-15T01:42:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:55:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 163" ], "sightings": 105, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.131.110", "classifications": [], "first_seen": { "$date": "2023-03-15T01:43:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:33:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 90, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "164.88.198.159", "classifications": [], "first_seen": { "$date": "2023-03-15T01:44:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:44:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Spamhaus DROP Listed Traffic Inbound group 15" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.165.191.124", "classifications": [], "first_seen": { "$date": "2023-03-15T01:45:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T01:45:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 22" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "190.129.122.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:46:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:36:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2599, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.131.39.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T01:47:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:59:30Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5505, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.195.134.141", "classifications": [], "first_seen": { "$date": "2023-03-15T01:47:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:40:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 24, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "179.99.37.226", "classifications": [], "first_seen": { "$date": "2023-03-15T01:50:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:47:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 33, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.199.106.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T02:18:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:39:04Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh", "Go", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.36.230.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T02:35:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:11:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 59, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.30.163.76", "classifications": [], "first_seen": { "$date": "2023-03-15T02:36:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:59:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 75, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.58.58.198", "classifications": [], "first_seen": { "$date": "2023-03-15T02:37:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:22:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 63, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "20.101.108.165", "classifications": [], "first_seen": { "$date": "2023-03-15T02:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:30:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 69, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.203.189.216", "classifications": [], "first_seen": { "$date": "2023-03-15T02:39:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-20T14:57:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 87, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "134.122.188.16", "classifications": [], "first_seen": { "$date": "2023-03-15T02:42:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T02:52:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 9, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "142.93.178.56", "classifications": [], "first_seen": { "$date": "2023-03-15T02:58:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:34:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 42", "ET SCAN Potential SSH Scan" ], "sightings": 102, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "140.238.122.212", "classifications": [], "first_seen": { "$date": "2023-03-15T03:03:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:03:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 40" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.168.142.91", "classifications": [], "first_seen": { "$date": "2023-03-15T03:05:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:05:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "208.109.38.20", "classifications": [], "first_seen": { "$date": "2023-03-15T03:12:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:53:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 124", "ET 3CORESec Poor Reputation IP group 28" ], "sightings": 183, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "181.28.101.14", "classifications": [], "first_seen": { "$date": "2023-03-15T03:12:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T03:15:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 88", "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan" ], "sightings": 461, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "186.31.95.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T03:15:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:29:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 95", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 780, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "118.40.248.20", "classifications": [], "first_seen": { "$date": "2023-03-15T03:15:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:32:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 27, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "217.144.54.180", "classifications": [], "first_seen": { "$date": "2023-03-15T03:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T03:44:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.161.174.204", "classifications": [], "first_seen": { "$date": "2023-03-15T03:44:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:29:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 108, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.199.130.106", "classifications": [], "first_seen": { "$date": "2023-03-15T03:46:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:14:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 48, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "188.166.58.179", "classifications": [], "first_seen": { "$date": "2023-03-15T03:47:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:11:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 99", "ET 3CORESec Poor Reputation IP group 23" ], "sightings": 18, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.131.253.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T04:15:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:44:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 113, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.105.207.239", "classifications": [], "first_seen": { "$date": "2023-03-15T04:15:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:15:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 32" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.74.102.216", "classifications": [], "first_seen": { "$date": "2023-03-15T04:28:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:28:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 3, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "161.82.233.179", "classifications": [], "first_seen": { "$date": "2023-03-15T04:42:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:42:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 65" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "80.107.50.128", "classifications": [], "first_seen": { "$date": "2023-03-15T04:42:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:18:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 179", "ET 3CORESec Poor Reputation IP group 44" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "36.66.195.234", "classifications": [], "first_seen": { "$date": "2023-03-15T04:43:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T05:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 140", "ET SCAN Potential SSH Scan" ], "sightings": 90, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "82.64.52.74", "classifications": [], "first_seen": { "$date": "2023-03-15T04:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T04:46:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 81", "ET SCAN Potential SSH Scan" ], "sightings": 24, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "72.175.198.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T05:45:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:48:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 73", "ET SCAN Potential SSH Scan", "SURICATA STREAM Packet with invalid timestamp", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 952, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1", "brute_force" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "36.156.186.58", "classifications": [], "first_seen": { "$date": "2023-03-15T05:56:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:00:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "177.220.173.9", "classifications": [], "first_seen": { "$date": "2023-03-15T06:31:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T06:43:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 21, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "110.49.17.95", "classifications": [], "first_seen": { "$date": "2023-03-15T06:59:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:36:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 15" ], "sightings": 168, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.203.8.38", "classifications": [], "first_seen": { "$date": "2023-03-15T07:35:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:35:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "91.134.197.35", "classifications": [], "first_seen": { "$date": "2023-03-15T07:41:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T07:46:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 164, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "124.223.47.170", "classifications": [], "first_seen": { "$date": "2023-03-15T08:28:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:42:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 156, "tags": [ "alert", "tcp", "ssh", "Go", "anomaly" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "192.151.223.2", "classifications": [], "first_seen": { "$date": "2023-03-15T08:36:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T08:37:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 408, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "220.90.185.168", "classifications": [], "first_seen": { "$date": "2023-03-15T09:07:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:05:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.223.12.224", "classifications": [], "first_seen": { "$date": "2023-03-15T09:45:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:45:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "Go", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.170.83.146", "classifications": [], "first_seen": { "$date": "2023-03-15T09:49:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:33:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "137.184.69.203", "classifications": [], "first_seen": { "$date": "2023-03-15T09:51:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T09:51:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "201.73.144.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T09:52:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:14:39Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "94.182.197.98", "classifications": [], "first_seen": { "$date": "2023-03-15T10:03:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:06:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.94.145.59", "classifications": [], "first_seen": { "$date": "2023-03-15T10:48:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:48:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.230.234.117", "classifications": [], "first_seen": { "$date": "2023-03-15T10:50:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T10:57:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack" ], "sightings": 120, "tags": [ "ssh", "tcp", "ssh", "ssh", "libssh2_1.4.3", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.23.20.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T11:22:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:21:05Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 57", "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "189.179.218.212", "classifications": [], "first_seen": { "$date": "2023-03-15T11:36:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:37:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.229.235.88", "classifications": [], "first_seen": { "$date": "2023-03-15T11:42:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:43:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "87.157.107.119", "classifications": [], "first_seen": { "$date": "2023-03-15T11:47:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:29:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 54, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.62.61.170", "classifications": [], "first_seen": { "$date": "2023-03-15T11:51:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T11:54:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "13.234.90.10", "classifications": [], "first_seen": { "$date": "2023-03-15T11:52:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T12:01:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET SCAN LibSSH Based Frequent SSH Connections Likely BruteForce Attack" ], "sightings": 116, "tags": [ "ssh", "tcp", "ssh", "ssh", "libssh2_1.4.3", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "220.133.157.9", "classifications": [], "first_seen": { "$date": "2023-03-15T13:10:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T13:11:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "24.199.118.157", "classifications": [], "first_seen": { "$date": "2023-03-15T13:31:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:19:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 40, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.48.60.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T13:34:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:58:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4460, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.114.1.46", "classifications": [], "first_seen": { "$date": "2023-03-15T13:35:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:28:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 126", "ET SCAN Potential SSH Scan" ], "sightings": 102, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "194.60.87.212", "classifications": [], "first_seen": { "$date": "2023-03-15T13:42:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:34:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 42, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.80.237.204", "classifications": [], "first_seen": { "$date": "2023-03-15T14:03:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:57:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 171", "ET SCAN Potential SSH Scan" ], "sightings": 102, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "118.185.105.201", "classifications": [], "first_seen": { "$date": "2023-03-15T14:17:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:17:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.89.170.52", "classifications": [], "first_seen": { "$date": "2023-03-15T14:32:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:33:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 76, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "89.248.165.51", "classifications": [], "first_seen": { "$date": "2023-03-15T14:52:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T14:52:25Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 2, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.152.45.232", "classifications": [], "first_seen": { "$date": "2023-03-15T15:34:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:34:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.130.151.201", "classifications": [], "first_seen": { "$date": "2023-03-15T15:42:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:56:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 22, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "146.190.227.169", "classifications": [], "first_seen": { "$date": "2023-03-15T15:50:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:50:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 48" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "13.77.174.169", "classifications": [], "first_seen": { "$date": "2023-03-15T15:53:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T15:53:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 35", "ET 3CORESec Poor Reputation IP group 11" ], "sightings": 4, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.129.82.220", "classifications": [], "first_seen": { "$date": "2023-03-15T15:54:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:43:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 32, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "96.78.175.36", "classifications": [], "first_seen": { "$date": "2023-03-15T16:16:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:04:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 40, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.8.160.224", "classifications": [], "first_seen": { "$date": "2023-03-15T16:16:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:16:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "78.46.248.137", "classifications": [], "first_seen": { "$date": "2023-03-15T16:16:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:07:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 42, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "66.97.41.132", "classifications": [], "first_seen": { "$date": "2023-03-15T16:16:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:30:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.233.118.143", "classifications": [], "first_seen": { "$date": "2023-03-15T16:19:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:13:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 34, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "160.120.247.113", "classifications": [], "first_seen": { "$date": "2023-03-15T16:20:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:20:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 63" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.223.66.230", "classifications": [], "first_seen": { "$date": "2023-03-15T16:47:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T16:49:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 24, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.143.2.179", "classifications": [], "first_seen": { "$date": "2023-03-15T17:46:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T17:50:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 132, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "221.155.133.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:28:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:34:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.193.146.10", "classifications": [], "first_seen": { "$date": "2023-03-15T18:31:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:31:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid timestamp" ], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "HELLOWORLD", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.248.226.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T18:43:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:53:14Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4585, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.215.167.146", "classifications": [], "first_seen": { "$date": "2023-03-15T18:44:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:30:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 40, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "163.172.207.166", "classifications": [], "first_seen": { "$date": "2023-03-15T18:44:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T19:24:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 58, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.236.181.164", "classifications": [], "first_seen": { "$date": "2023-03-15T18:45:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T18:45:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 115" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.189.37.175", "classifications": [], "first_seen": { "$date": "2023-03-15T20:07:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:34:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 40, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.225.218.222", "classifications": [], "first_seen": { "$date": "2023-03-15T20:09:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:39:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.15.204.199", "classifications": [], "first_seen": { "$date": "2023-03-15T20:09:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:09:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 163" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.143.128.117", "classifications": [], "first_seen": { "$date": "2023-03-15T20:36:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:29:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 24", "ET SCAN Potential SSH Scan" ], "sightings": 104, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "148.72.209.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T20:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:07:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 50", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1126, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "128.199.211.78", "classifications": [], "first_seen": { "$date": "2023-03-15T20:38:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T20:56:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 22, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "89.248.165.100", "classifications": [], "first_seen": { "$date": "2023-03-15T21:10:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:34:11Z" }, "ports": [ 22, 3381 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET CINS Active Threat Intelligence Poor Reputation IP group 85", "(port_scan) TCP portscan" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "52.250.18.40", "classifications": [], "first_seen": { "$date": "2023-03-15T21:42:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T22:37:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 42, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.135.208.210", "classifications": [], "first_seen": { "$date": "2023-03-15T21:42:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:42:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 3" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "130.185.73.141", "classifications": [], "first_seen": { "$date": "2023-03-15T21:44:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:44:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 29" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.75.65.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T21:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:23:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 90", "ET 3CORESec Poor Reputation IP group 21", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 154, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "44.211.75.102", "classifications": [], "first_seen": { "$date": "2023-03-15T21:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:06:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 52, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.252.230.62", "classifications": [], "first_seen": { "$date": "2023-03-15T21:48:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T21:51:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 158, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "159.65.41.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T22:05:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:52:11Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62", "ET 3CORESec Poor Reputation IP group 16", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12189, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.227.153.141", "classifications": [], "first_seen": { "$date": "2023-03-15T22:06:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T22:35:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 30, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.99.239.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T22:06:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:14:29Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 76", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3084, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "61.177.173.50", "classifications": [], "first_seen": { "$date": "2023-03-15T23:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:16:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) server version string overflow" ], "sightings": 565, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.23.111.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:26:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:02:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11262, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.194.112.46", "classifications": [], "first_seen": { "$date": "2023-03-15T22:21:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T22:22:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 92, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "91.107.165.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:28:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:43:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6769, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.131.29.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:29:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:39:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5077, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "57.79.251.176", "classifications": [], "first_seen": { "$date": "2023-03-15T22:54:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:08:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 32, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "37.230.211.45", "classifications": [], "first_seen": { "$date": "2023-03-15T22:55:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:07:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 141", "ET SCAN Potential SSH Scan" ], "sightings": 55, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "81.29.214.123", "classifications": [], "first_seen": { "$date": "2023-03-15T23:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:05:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 181" ], "sightings": 62, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.91.151.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:06:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:03:12Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 166", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4943, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "213.225.12.148", "classifications": [], "first_seen": { "$date": "2023-03-15T23:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:06:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 31, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "14.161.41.252", "classifications": [], "first_seen": { "$date": "2023-03-15T23:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:53:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 27, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "27.112.79.217", "classifications": [], "first_seen": { "$date": "2023-03-15T23:50:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:50:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "104.168.68.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:51:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:27:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 10", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.63.169.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:31:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:51:48Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9192, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.110.233.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:31:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:51:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6763, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.240.157.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:33:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:51:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5075, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.76.252.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:33:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:46:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4511, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.114.195.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:34:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:54:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8901, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.222.96.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T23:52:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:52:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1126, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.44.145.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T23:52:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:52:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1126, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.157.63.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:58:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1687, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.173.87.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T23:54:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:49:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2200, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.139.15.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:54:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:08:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6736, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.196.196.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:54:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:59:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1686, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.72.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-15T23:55:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:09:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5612, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.200.229.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-15T23:56:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-15T23:56:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.122.221.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T00:09:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:14:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5018, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.39.25.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T00:19:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:19:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.189.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T00:28:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:11:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2190, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.227.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T00:31:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:27:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.52.99.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:33:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6134, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.27.67.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:34:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:51:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6687, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.178.141.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:34:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:02:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16663, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.131.72.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:36:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:38:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5604, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.135.126.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:37:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:50:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6132, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.168.126.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:37:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:45:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1124, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "130.193.42.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:38:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:49:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5019, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.244.172.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:44:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:57:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5547, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.41.141.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:45:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:00:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6656, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.182.245.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T00:53:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T00:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1108, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.152.52.230", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-16T01:03:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:05:52Z" }, "ports": [ 0, 53, 1900, 177, 1023, 161, 626, 162, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) TCP portscan", "INDICATOR-SCAN UPnP service discover attempt", "(port_scan) UDP portscan", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP trap udp", "(sip) content length mismatch" ], "sightings": 79774, "tags": [ "icmp", "tcp", "udp", "xdmcp", "snmp", "snmptrap" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "202.46.154.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T01:09:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:49:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10944, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.225.255.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T01:13:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:29:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6021, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "223.93.165.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T01:15:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:00:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5475, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "209.74.104.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T01:24:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:24:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1094, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.134.203.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T01:26:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:26:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1094, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "73.61.2.255", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T01:52:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T01:52:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1094, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.248.120.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:04:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:22:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4908, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.115.241.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:04:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:22:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5421, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.177.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:19:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5455, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.24.207.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:09:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:50:04Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4921, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.70.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:09:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:45:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5494, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "168.205.13.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:09:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:20:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3817, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.213.141.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:12:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:21:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3816, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.37.0.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:13:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:27:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5446, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.189.91.157", "classifications": [], "first_seen": { "$date": "2023-03-16T02:15:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:47:16Z" }, "ports": [ 33302, 37272, 44981, 53278, 50857, 59374, 46816, 44044, 35529, 33059, 34205, 43615, 43769, 37367, 51723, 45869, 46977, 49642, 57999, 55073, 60264, 56162, 60714 ], "reporting_nodes": 2, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 44560, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "50.82.229.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:17:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:17:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1090, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.172.248.97", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:22:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:40:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5431, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.43.149.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:23:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:04:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9207, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.247.104.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:23:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:40:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4887, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.216.222.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:23:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:51:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10848, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.22.1.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:25:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:40:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4886, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.230.231.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:26:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:26:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 544, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.197.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:26:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:39:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4344, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.61.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:27:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:37:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5432, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.190.102.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:12:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15680, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.101.50.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:34:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:34:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 543, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.159.226.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:35:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:49:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4876, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.186.240.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:35:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:51:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5958, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.130.154.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:37:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:33:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9513, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.209.118.235", "classifications": [], "first_seen": { "$date": "2023-03-16T02:40:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:40:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 542, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.67.221.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T02:43:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:44:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1084, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.117.171.94", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T02:47:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:47:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2710, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "93.139.88.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T02:59:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T02:59:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T03:02:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:11:18Z" }, "ports": [ 80, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 596, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "95.214.55.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T03:05:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:18:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2160, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.61.104.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T03:26:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:26:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.184.2", "classifications": [], "first_seen": { "$date": "2023-03-16T03:30:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T03:30:18Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 539, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "184.105.139.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T03:30:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:08:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1084, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.84.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T03:43:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:03:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4304, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.147.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T04:06:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:00:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1080, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.232.110.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T04:21:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:21:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 537, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.25.101.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T04:37:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T04:37:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1074, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.212.169", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-16T05:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:15:14Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 1101, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.221.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:06:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:06:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1074, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.105.223", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:09:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:40:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1086, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.116.139.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:12:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:12:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1072, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.201.44.249", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:31:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:39:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7085, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.128.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:40:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:40:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1072, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.74.104.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:40:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:40:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1072, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.81.147.30", "classifications": [], "first_seen": { "$date": "2023-03-16T05:53:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:41:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 2070, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "69.61.31.229", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:54:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 5345, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "193.37.215.136", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:54:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 10680, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "62.113.202.78", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:54:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13311, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "172.93.189.117", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:54:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:54:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13275, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "96.9.226.14", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:55:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:55:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 10605, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "172.93.222.153", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T05:55:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:55:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 5300, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "1.34.96.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T05:57:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T05:57:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1060, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.69.196.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T06:12:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:12:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 530, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.148.120.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T06:17:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:02:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2092, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.210.13.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T06:26:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:54:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2082, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T06:27:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:16:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10181, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.146.240.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T06:28:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:28:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1060, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.104.220.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T06:33:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:43:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1059, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.136.157.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T06:39:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T06:39:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1060, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.237.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T06:48:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:38:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1366, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.232.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T07:18:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:18:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1056, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.171.198.45", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T07:22:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:22:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2639, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "173.255.226.218", "classifications": [], "first_seen": { "$date": "2023-03-16T07:24:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:12:09Z" }, "ports": [ 9000, 3389, 50001, 4443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 9075, "tags": [ "tcp", "rdp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.81.83.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T07:40:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:40:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1054, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.255.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T07:46:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T07:46:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1052, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.241.121.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T07:51:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:08:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1860, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.29.231.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T07:55:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:51:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 4827, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.247.37.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T07:55:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:05:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2095, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.164.39.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T07:59:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:07:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3139, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.178.80.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T08:02:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:03:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1046, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.244.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T08:03:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:57:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.74.85.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T08:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:08:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1044, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.134.178.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T08:12:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:13:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1044, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.145.179.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T08:21:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:39:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6244, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.255.4.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T08:21:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:37:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1041, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.180.128.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T08:21:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:46:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4679, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "2.59.119.241", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-03-16T08:25:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:08:43Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5066, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "184.105.247.223", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T08:29:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:20:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1046, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T08:30:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:28:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9053, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.117.116.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T08:42:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:58:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4665, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.83.12.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T08:42:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:59:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3110, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.207.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T08:46:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:19:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2204, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.1.248.44", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T08:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:49:23Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1557, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "128.1.248.43", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T08:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:49:23Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1557, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "128.1.248.42", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T08:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T08:49:23Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1556, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.200.116.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T09:03:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:40:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.165.78.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T09:07:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:07:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2064, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.36.137.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T09:10:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:10:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 516, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.95.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T09:12:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:25:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5153, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.43.231.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T09:17:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T18:22:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET CINS Active Threat Intelligence Poor Reputation IP group 8" ], "sightings": 1088, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.62.197.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T09:20:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:50:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1904, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T09:21:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:44:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1034, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.211.59.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T09:22:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T09:37:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5150, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.148.122.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T09:40:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:09:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4354, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.148.121.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T09:58:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:14:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.84.24.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T10:00:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:00:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1026, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.7.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T10:16:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:28:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3589, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.248.43.169", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-03-16T10:18:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:39:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-ICMP PING BSDtype", "PROTOCOL-ICMP PING Unix", "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING" ], "sightings": 83678, "tags": [ "icmp" ], "rule_count": 6, "classification_count": 2 }, { "ioc": "158.101.194.203", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T10:21:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:16:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8126, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T10:25:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:34:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.63.10.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T10:41:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:55:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3047, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "98.147.172.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T10:43:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T10:43:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1020, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.83.148.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T10:46:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:00:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4058, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "60.196.69.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T10:55:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:26:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10103, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.22.220.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T11:02:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:31:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1904, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.153.130.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T11:03:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:03:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1012, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.192.216.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T11:09:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:09:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1012, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.192.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T11:25:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:25:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1008, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.239.242.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T11:29:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T11:29:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1008, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.163.213.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T11:52:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:05:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4525, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.133.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T11:52:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:08:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5529, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.247.198.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T11:54:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:54:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 115858, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "168.232.152.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T11:56:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:08:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3014, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.35.34.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T12:04:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:04:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1004, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.197.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T12:08:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:25:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4517, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.211.46.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T12:12:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:24:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3513, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.174.156.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T12:14:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:14:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1004, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.176.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T12:20:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:39:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6009, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.28.205.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T12:21:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:22:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2008, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "99.149.251.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T12:22:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:50:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10006, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.65.173.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T12:36:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2192, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.159.85.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T12:39:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:39:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1000, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.163.61.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T12:41:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T12:41:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2500, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "117.178.205.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T12:42:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:31:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2882, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.14.134.134", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T13:08:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T13:08:39Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4491, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "114.44.34.64", "classifications": [], "first_seen": { "$date": "2023-03-16T13:09:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T13:09:36Z" }, "ports": [ 88 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 998, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.186.170.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T13:20:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:13:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3318, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.10.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T13:22:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T13:31:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2483, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.195.107.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T13:24:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T13:38:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4963, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.70.43.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T13:24:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T13:37:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5459, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.159.156.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T13:43:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:07:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3330, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.173.144.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T13:55:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:20:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3986, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.114.245.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T13:56:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:33:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5994, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.115.27", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T13:57:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:02:47Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3720, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.189.8.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:05:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T14:05:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 990, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.130.160.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:07:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:25:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1704, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.168.171.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:15:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:38:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2502, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.225", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:22:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:03:14Z" }, "ports": [ 161, 0, 22 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(ssh) payload size incorrect for the given payload" ], "sightings": 6040, "tags": [ "udp", "snmp", "icmp", "tcp", "ssh" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "3.88.173.21", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-16T14:36:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T14:36:56Z" }, "ports": [ 113, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 1485, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.34.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T14:42:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T14:58:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2966, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.204.50.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:48:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:42:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.138.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:48:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:55:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1974, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.42.108.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:54:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:07:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46824, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.107.10.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:56:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:13:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1972, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.228.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:59:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:52:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1916, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.95.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T14:59:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T14:59:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.130.113.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T15:02:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:03:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 986, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.103", "classifications": [], "first_seen": { "$date": "2023-03-16T15:11:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:11:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 493, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.119.35", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-16T15:16:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:28:49Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 4839, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.93.247.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T15:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:30:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3254, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.232.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T15:23:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:37:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4428, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.93.23.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T15:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:41:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4428, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "142.93.151.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T15:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:36:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4428, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.219.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T15:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:05:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1882, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.220.148.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T15:33:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:46:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3936, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.148.236.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T15:33:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:07:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.159.49.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T15:34:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:09:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 154", "ET SCAN Potential SSH Scan" ], "sightings": 4213, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.128.232.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T15:37:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:10:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2866, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.216.119.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T15:40:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T15:40:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 984, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.196.254.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:02:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:02:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 984, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "108.49.29.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:03:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:41:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2930, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.122.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:10:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:09:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.183.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T16:11:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:26:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4918, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.127.184.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T16:12:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:13:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 984, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.37.212.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T16:13:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:08:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62680, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.232.13.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T16:14:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:33:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4912, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.72.147.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T16:14:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:25:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1967, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.213.174.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T16:15:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:29:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4915, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.224.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T16:17:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:33:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4421, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.140.95.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:28:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:08:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1908, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.23.17.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:38:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:38:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 978, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.213.242.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:47:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3540, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.180.86.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5161, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.136.80.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T16:48:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T16:48:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 978, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.159.155.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:53:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:15:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2252, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.226.141.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T16:57:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:48:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1852, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.245.12", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T17:05:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:41:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2059, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "59.89.237.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T17:07:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:07:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 978, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.152.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T17:08:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:30:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.242.101.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T17:09:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:26:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4401, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.128.228.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T17:09:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:27:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 2934, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.158.146.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T17:10:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:47:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8838, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.152.60.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T17:12:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:21:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1956, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "197.85.7.15", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-16T17:48:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:27:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 39200, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "165.22.96.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T17:51:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:54:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4398, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.95.180.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T17:51:50Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T22:41:10Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "SURICATA STREAM Packet with invalid timestamp", "ET SCAN Potential SSH Scan" ], "sightings": 5748, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.162.216.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T17:52:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:20:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5557, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.179.57.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T17:56:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:09:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3418, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.138.49.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T17:58:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T17:58:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 978, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.55.177.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T18:05:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:56:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7924, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.192.213.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T18:40:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:56:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2506, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.159.213.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T18:53:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:09:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5334, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "106.167.219.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T18:56:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T18:56:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 972, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.212.128.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T19:00:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:14:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1938, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.194.61.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T19:17:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:17:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 968, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.39.156.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T19:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:02:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2746, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.96.151.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T19:40:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:23:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13920, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.216.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T19:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:50:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2415, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.237.10.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T19:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:58:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4828, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.198.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T19:43:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:57:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5794, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.151.210.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T19:48:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T19:55:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 966, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.148.152.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T19:58:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33873, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.104.146.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T19:58:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:15:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11490, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.96.129.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T19:59:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:20:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4304, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.209.230.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T20:00:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:13:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5269, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "12.217.17.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T20:03:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:13:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3347, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "77.254.209.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T20:03:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:03:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 960, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "132.145.139.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T20:03:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:19:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5730, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.198.85.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T20:08:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:28:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3341, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.56.11.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T20:09:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:09:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 957, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T20:17:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:53:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25772, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.224.15", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T20:24:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:28:36Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1461, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.237.22", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-16T20:28:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:28:15Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1431, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "152.32.217.103", "classifications": [], "first_seen": { "$date": "2023-03-16T20:29:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T20:29:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 477, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "60.190.242.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T20:50:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:01:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.118.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T21:05:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T21:22:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1908, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.188.89.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T21:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T21:06:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 954, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.193.42.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T21:21:59Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:33:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3372, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.53.83.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T21:23:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:14:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2328, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.5.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:06:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:33:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4695, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.231.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:08:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:24:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9499, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.5.159.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:08:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:27:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4666, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.186.252.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:10:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:52:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13913, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.216.103.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:11:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:26:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4199, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "3.108.249.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:03:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13906, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.8.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:20:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 466, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.33.108.41", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-03-16T22:23:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:06:19Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2781, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "202.169.46.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:24:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:42:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4193, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.51.161.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T22:32:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:09:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1830, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.187.80.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:33:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:48:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3723, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.167.92.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T22:36:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:18:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4486, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.129.188.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T22:37:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:45:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.1.226.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:39:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:40:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 932, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.26.176.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:44:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:00:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 4638, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.131.248.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:46:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:56:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2785, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.230.114.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T22:47:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:27:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1848, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.85.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:48:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:01:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3710, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.140.2.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:50:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:04:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4635, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.194.27.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T22:58:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T22:58:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 926, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.204.82.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T22:58:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:49:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 11349, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.2.192.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T23:10:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:10:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 926, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.152.216.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T23:17:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:34:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3700, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.224.177.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T23:19:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:19:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 926, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "105.174.43.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T23:20:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:55:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11118, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.36.184.253", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T23:21:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:28:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1388, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.186.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-16T23:22:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:34:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4162, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.134.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T23:27:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:27:37Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1389, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.210.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T23:28:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:15:50Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1926, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.83.245.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T23:38:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:37:37Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 7452, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "217.160.0.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T23:39:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-16T23:39:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 923, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.243.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T23:56:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:36:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 930, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.223.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-16T23:57:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:39:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9244, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.90.187.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T00:09:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:12:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1730, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.35.49.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T00:11:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:11:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 922, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.96.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T00:15:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:15:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 920, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.251.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T00:20:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:20:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 918, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T00:30:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:01:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 932, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.245.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T00:31:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:48:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4116, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.138.150.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T00:35:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T00:52:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.185.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T00:51:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:21:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8609, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.172.112.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T00:57:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:11:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4986, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.117.128.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T00:59:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:45:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 714188, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "41.207.252.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T00:59:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:51:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13559, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "116.117.157.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T01:05:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T01:05:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4530, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.155.57.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T02:01:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:01:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.192.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T02:09:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:09:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.6.150.114", "classifications": [], "first_seen": { "$date": "2023-03-17T02:27:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:29:55Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 1341, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.250.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T02:35:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:37:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 902, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.143.199.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T02:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:51:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3111, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.17.16.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T02:38:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:49:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 447, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.58.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T02:38:20Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:52:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4442, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.113.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T02:40:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:37:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7095, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "174.138.19.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T02:41:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:03:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1592, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.110.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T02:42:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:54:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26856, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.116.145.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T02:44:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:44:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 890, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.97.235.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T02:56:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T02:56:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 886, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.247.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T03:10:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:14:37Z" }, "ports": [ 0, 80 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(stream_tcp) data on SYN packet" ], "sightings": 24938, "tags": [ "icmp", "tcp", "http" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "34.121.171.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T03:13:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:48:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.19.4.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T03:33:54Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:51:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4871, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "20.198.66.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T03:35:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:49:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3987, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.175.160.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T03:37:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:51:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4871, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T03:45:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:53:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 894, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.20.21.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T03:49:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T03:50:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 884, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.221.202.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T04:07:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:20:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3516, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "196.203.182.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T04:14:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:55:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.167.55.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T04:15:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:47:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1522, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.103.118.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T04:16:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:17:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 878, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.2.64.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T04:19:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:20:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 878, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.81.194.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T04:21:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Time-To-Live Exceeded in Transit" ], "sightings": 874, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.130.188.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T04:35:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:21:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 66004, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T04:40:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:40:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 874, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.141.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T04:41:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:07:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 902, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.126.156.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T04:50:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:50:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 874, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.3.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T04:58:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:15:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4348, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.201.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T04:58:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T04:58:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 874, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.46.28.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T05:08:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:08:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 870, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.225.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T05:17:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:17:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 866, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.95.69.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T05:19:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:20:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 864, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.213.22.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T05:22:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:37:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4320, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.170.115.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T05:22:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:23:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 864, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.196.76.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T05:25:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:25:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 432, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.105.99.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T05:37:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:08:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4815, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.10.240.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T05:40:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:02:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.242.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T05:40:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T05:51:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3448, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.94.138.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T06:06:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:28:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11196, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.56", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-03-17T06:10:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:53:22Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1288, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "190.64.68.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:10:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:29:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4259, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.74.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:10:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:32:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5106, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.35.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:11:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:28:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1313, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.198.89.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T06:11:58Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:11:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 854, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.68.160.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:16:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:21:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1279, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.185.117.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T06:21:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:12:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1684, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.120.166.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:25:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:25:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 850, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.161.41.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:27:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:09:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12685, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "116.206.124.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:30:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:21:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11398, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "13.71.84.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:30:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:39:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.98.115.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T06:31:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:31:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 848, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.204.134.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T06:45:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:11:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1690, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.23.148.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T06:48:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:58:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3803, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.43.182.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T06:50:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T06:50:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 848, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.6", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-17T06:59:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:46:58Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17393, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "181.224.94.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T07:00:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:15:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3789, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "74.82.47.14", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-17T07:02:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:02:34Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1263, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "187.140.214.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T07:11:17Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:29:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4631, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.139.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T07:14:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:14:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 842, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.34.29.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T07:21:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:21:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 842, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.232.122.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T07:27:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:29:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1574, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.152.182.241", "classifications": [], "first_seen": { "$date": "2023-03-17T07:36:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:36:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) partial start line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 834, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.127.102.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T07:45:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T07:45:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "153.136.109.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T08:04:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:04:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 832, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.111.250.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T08:08:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:30:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1628, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.182.68.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T08:08:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:09:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 832, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.118.53.141", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic", "Detection of a Network Scan", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-03-17T08:19:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:39:06Z" }, "ports": [ 0, 1434, 161, 69, 1900, 111 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 38877, "tags": [ "icmp", "udp", "snmp", "tftp", "sunrpc", "portmapper" ], "rule_count": 10, "classification_count": 5 }, { "ioc": "192.241.203.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T08:23:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:56:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 834, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.118.53.142", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-17T08:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:25:47Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 4549, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "193.118.53.138", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-17T08:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:25:47Z" }, "ports": [ 1434, 0, 161 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 4546, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "152.70.113.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T08:24:43Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:39:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3717, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.236.128.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T08:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:34:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 868, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.76.223.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T08:28:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:44:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4543, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.209.104.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T08:33:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:33:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 413, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.240.81.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T08:35:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:10:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 418, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.1.41.5", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-17T08:37:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:37:04Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 413, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.126.124.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T08:38:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:47:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1652, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.246.127.142", "classifications": [], "first_seen": { "$date": "2023-03-17T08:50:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T08:50:33Z" }, "ports": [ 8083 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 824, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "123.200.20.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T08:50:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:03:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3708, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.200.116.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T08:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:54:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1638, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.235.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T09:07:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:39:14Z" }, "ports": [ 1434, 0, 5060 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 2316, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "192.241.227.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T09:08:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:08:02Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1236, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "187.189.92.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T09:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:50:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6144, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "67.42.70.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T09:09:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:09:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 412, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.210.119.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T09:12:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:51:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6143, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.43.231.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T09:15:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:53:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12276, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.92.170.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T09:16:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:52:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12277, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.200.36.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T09:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:26:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 820, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.118.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T09:26:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:26:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 820, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.252.116.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T09:33:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:33:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 818, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.231.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T09:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T09:36:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 816, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.32.121.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T09:45:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:10:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1612, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.70.39.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T09:45:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:01:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3248, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.135.132.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T09:55:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:07:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4043, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.58.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T09:56:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:03:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2426, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.237.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T10:12:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:04:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10452, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.107.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T10:15:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:15:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 806, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.11", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-17T10:24:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:32:25Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 848, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "104.236.128.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T10:25:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:05:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 860, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.187.94.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T10:25:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:42:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2418, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.182.210.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T10:31:33Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:33:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2549, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.112.109", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-03-17T10:36:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:36:34Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1209, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "204.112.47.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T10:47:28Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T10:47:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 804, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.74.104.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T11:03:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:03:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 802, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.151.135.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T11:08:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:06:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 990, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.198.252.94", "classifications": [], "first_seen": { "$date": "2023-03-17T11:13:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:13:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 800, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "66.170.208.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T11:17:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:18:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 799, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.28", "classifications": [], "first_seen": { "$date": "2023-03-17T11:28:27Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T11:28:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 398, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.142.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T11:30:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:21:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 842, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.237.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T11:40:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:51:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 804, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.94", "classifications": [], "first_seen": { "$date": "2023-03-17T11:40:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:37:55Z" }, "ports": [ 53910, 28665, 14332, 21433, 3077, 24668, 65513, 18953 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 30960, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "3.9.165.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T12:58:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:04:22Z" }, "ports": [ 2083, 9013, 10243, 39868, 0, 5683 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) UDP portscan" ], "sightings": 23027, "tags": [ "tcp", "icmp", "udp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "93.159.194.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T13:10:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:10:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 776, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.235.207.155", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T13:17:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:17:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7600, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "131.255.6.64", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T13:31:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:31:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1815, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.233.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T13:33:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:33:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 726, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.115.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T13:41:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:41:23Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1080, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "110.49.17.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T13:54:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:17:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4629, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.205.177.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T13:55:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:26:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6759, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.172.130.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T13:59:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T13:59:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 716, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.186.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T13:59:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:12:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2849, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.238.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T13:59:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:47:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10649, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.161.17.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T13:59:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:12:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2848, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.226.37.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:07:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:57:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10618, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.206.104.148", "classifications": [], "first_seen": { "$date": "2023-03-17T14:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:09:26Z" }, "ports": [ 8080 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 710, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.197.117.73", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-17T14:17:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:17:47Z" }, "ports": [ 445, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 1065, "tags": [ "tcp", "smb", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "157.245.157.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:28:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:39:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2125, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.125.140.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:30:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:01:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 2465, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.212.231.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:30:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:29:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10467, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.79.143.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:31:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:47:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2831, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.211.14.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:33:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:46:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2477, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.165.245.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T14:43:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:43:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.85.32.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T14:48:32Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T14:48:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 704, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.94.40.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:55:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:10:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3155, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.59.127.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:58:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:12:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3497, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.126.176.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:58:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:15:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3137, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.110.183.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:59:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-21T06:27:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2891, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.9.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T14:59:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:22:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2839, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.193.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T15:01:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:09:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2803, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "217.112.92.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T15:04:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:20:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3452, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.116.134.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T15:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:08:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 700, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.128.234.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T15:08:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:13:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16344, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.152.52.226", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-17T15:14:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:15:04Z" }, "ports": [ 0, 4244, 1900, 136, 162, 53, 161, 500, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) TCP portscan", "INDICATOR-SCAN UPnP service discover attempt", "(port_scan) UDP portscan", "PROTOCOL-SNMP trap udp", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "(sip) content length mismatch" ], "sightings": 64056, "tags": [ "icmp", "tcp", "udp", "snmptrap", "snmp" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "103.152.18.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T15:24:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:40:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3069, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.126.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T15:27:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:38:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3073, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.250.175.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T15:38:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:38:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 680, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.184", "classifications": [ "Misc activity", "Attempted Information Leak", "Information Leak" ], "first_seen": { "$date": "2023-03-17T15:41:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:58:09Z" }, "ports": [ 5632, 0, 161 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3595, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 8, "classification_count": 3 }, { "ioc": "162.243.151.4", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T15:56:55Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T15:56:55Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1348, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T16:44:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:59:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 666, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.151.136.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T16:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T16:46:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.171.56.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T17:08:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T17:08:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 660, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.166.65.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T17:23:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T17:24:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 658, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.176.77.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T17:26:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T17:30:15Z" }, "ports": [ 7754, 8084, 0, 389 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) UDP portscan" ], "sightings": 12794, "tags": [ "tcp", "icmp", "udp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "198.235.24.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T17:36:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T17:36:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 654, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.187.45.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T17:39:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T08:51:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 3878, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.148.232.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T17:41:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:26:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-ICMP PING BSDtype", "PROTOCOL-ICMP PING Unix", "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "49.7.113.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T17:52:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T17:52:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 652, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.221.92.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T18:03:06Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:13:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1248, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.144.142.140", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T18:05:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:44:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4850, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.172.86.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T18:08:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:08:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.178.205.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T18:15:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:05:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1228, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.186.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T18:19:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:09:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 680, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.229.33.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T18:26:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:26:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 646, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.7.222.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T18:30:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:30:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 646, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.163.53", "classifications": [], "first_seen": { "$date": "2023-03-17T18:32:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:37:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 7084, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.143.195.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T18:46:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:32:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9597, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.162.210.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T18:50:39Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:11:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 2887, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T18:55:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:12:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16629, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.226.48.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T18:56:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T18:57:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 642, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.52.0.83", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T19:01:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:01:35Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6420, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "220.133.112.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T19:01:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:02:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 642, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.6.102.54", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T19:12:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:12:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1965, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.253.8", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T19:41:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:41:13Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 948, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "123.131.159.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T19:56:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T19:56:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 628, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.252.84.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:10:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:30:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3403, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.150.69.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:11:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:21:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1868, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.130.18", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-17T20:15:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:23:40Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 13339, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "139.59.78.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:21:05Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:39:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3363, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.232.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:22:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:40:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3359, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.17.16.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:23:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:30:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 311, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.98.181.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:24:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:36:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1833, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.109.43.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:25:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:37:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1223, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.196.10.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:25:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:40:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2746, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.103.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:25:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:38:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3052, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.212.16.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:25:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:41:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3659, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.71.232.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:29:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:43:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1521, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.82.57.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:30:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:07:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3032, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.142.174.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:33:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:15:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2725, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "42.193.111.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T20:44:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:44:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1515, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "152.32.151.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:53:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:53:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 303, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.132.109.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T20:55:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:49:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1196, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.229.230.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T20:56:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:56:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.30.217.183", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:56:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:56:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 606, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.224.155.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T20:58:03Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T20:58:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 303, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.238.157.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T21:07:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:07:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 302, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "18.170.227.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T21:12:24Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:18:12Z" }, "ports": [ 9093, 3333, 61293, 8853, 0, 123 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) UDP portscan" ], "sightings": 12262, "tags": [ "tcp", "icmp", "udp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "210.209.179.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T21:23:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:23:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 596, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.95.1.25", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-17T21:28:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:28:49Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1192, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "180.52.92.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T21:31:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:31:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 596, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.146.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T21:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:33:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1192, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.150.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T21:42:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:42:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 592, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.19.100.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T21:49:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T21:49:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.17.53.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:02:46Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:02:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 294, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.20.15.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:21:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2940, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.255.106.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T22:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:22:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 594, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.37.101.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:33:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2940, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.99.36.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:17:38Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:15:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5816, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.224.128.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T22:23:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:35:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1090, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.82.175.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:48:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:02:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2038, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "94.70.166.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:49:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:28:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3889, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.178.169.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-17T22:49:48Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T22:53:25Z" }, "ports": [ 9009, 2079, 9114, 0 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11383, "tags": [ "tcp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "92.222.10.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:51:51Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:04:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2619, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.101.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:54:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:39:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8523, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.116.141.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:57:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:46:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8474, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "173.249.48.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T22:59:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:13:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2886, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "85.112.69.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T23:02:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:18:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1717, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.10.138.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T23:04:09Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:20:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3138, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "158.69.168.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T23:04:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:21:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3987, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.116.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T23:04:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:17:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3148, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.156.155.10", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-17T23:13:30Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:13:30Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 568, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.174.134.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T23:32:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-17T23:32:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 560, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.61.185.130", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-03-17T23:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:02:40Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1587, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.85.160.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-17T23:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:13:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2189, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.208.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T00:14:12Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:14:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.224.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T00:19:13Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:19:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 536, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.55.0.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T00:23:19Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:23:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 536, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.172.155.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T00:28:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:44:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 536, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T00:31:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:06:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1056, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.133.112.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T00:32:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:16:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2497, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.168.213.134", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T00:34:37Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:34:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 532, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.230.135.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T00:48:25Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T00:48:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 528, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.182.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T00:50:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:03:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3148, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.210.144.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T01:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:13:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2095, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "149.56.78.26", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-03-18T01:04:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T21:28:47Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 3844, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "207.180.214.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T01:26:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:26:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 522, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.130.148.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T01:37:49Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T01:51:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2841, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.130.63.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T01:40:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T21:29:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 966, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.72.69.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T02:04:10Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:04:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.20.60.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T02:08:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:37:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 984, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.90.202.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T02:26:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:21:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.168.112.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T02:35:34Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:36:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1004, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T02:36:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:36:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 502, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "207.134.193.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T02:36:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T02:36:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 502, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.199.139.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T03:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:08:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 496, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.239.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T03:12:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:12:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.234.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T03:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:14:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.189.26.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T03:16:52Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:16:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "199.195.252.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T03:20:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:06:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 988, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.112.10.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T03:26:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:12:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1478, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.192.137.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T03:26:42Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:26:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.127.24.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T03:38:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:39:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 988, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.79.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T03:52:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:28:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7353, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.244.37.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T03:54:00Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:01:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1479, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.222.7.166", "classifications": [], "first_seen": { "$date": "2023-03-18T03:54:21Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:54:21Z" }, "ports": [ 21171 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP PDU missing ack for established session", "(tcp) TCP urgent pointer exceeds payload length or no payload" ], "sightings": 494, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "186.98.39.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T03:55:47Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:55:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 247, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.81.24.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T03:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:09:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2461, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.97.218.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T03:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:07:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1723, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.192.244.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T03:56:59Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:11:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2460, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.140.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T03:57:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T03:57:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 494, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.141.40.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T04:01:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:01:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 492, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.180.162.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-03-18T04:07:49Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:40:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7126, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "112.16.212.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T04:21:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:21:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 487, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.190.8.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T04:26:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:26:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 486, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.9.171.59", "classifications": [], "first_seen": { "$date": "2023-03-18T04:31:40Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T04:35:02Z" }, "ports": [ 8089, 2869, 1024, 5269 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 968, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.15.147.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T04:32:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:17:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 962, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.147.90.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T05:00:01Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:00:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Time-To-Live Exceeded in Transit" ], "sightings": 480, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.74.88.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T05:04:44Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:05:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 480, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.17.17.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T05:15:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:02:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 241, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.97", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-03-18T05:19:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:05:08Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 2801, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.155.48.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T05:22:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:22:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 474, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.186.223", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T05:28:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:10:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 562, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.7.178.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T05:45:56Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T05:47:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 474, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.208.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T05:55:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:03:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 494, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.247.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T06:00:57Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:00:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 472, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.96.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T06:02:35Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:19:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2344, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.68.121.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T06:06:04Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:21:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3045, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "31.187.75.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T06:45:45Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:59:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1834, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "83.229.84.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T06:51:18Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T06:51:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 458, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.231.112.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T06:58:36Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:12:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3394, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.144.98.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T06:59:23Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:10:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2039, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.143.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T06:59:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:55:31Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2329, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.124.32.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T07:14:41Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:14:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 450, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.154.108.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T07:29:31Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:50:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3551, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.237.243.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-18T07:48:50Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T07:48:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 440, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.143.43.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T08:47:07Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T08:47:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 220, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.64.24.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T08:47:53Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T08:47:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 220, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.168.56.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-03-18T08:48:02Z" }, "ja3": [], "last_seen": { "$date": "2023-03-18T08:48:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 220, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.224.186.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-20T13:57:16Z" }, "ja3": [], "last_seen": { "$date": "2023-03-20T13:57:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 440, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.111.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-20T14:03:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:51:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14145, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.0.218.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-03-20T14:03:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:59:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19430, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.83.22.183", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:03:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13675, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.69.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:57:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15788, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.222.217.149", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:54:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17340, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.213.134", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:02:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15708, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.26.222", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13372, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.56.54", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:23:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.60.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20868, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.190.216", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:01:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16903, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.86.73", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:57:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14769, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.55.28", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13223, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.157.11", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 23780, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.113.64", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:43:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8427, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.156.73.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T21:40:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:26:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6158, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "140.179.224.119", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:40:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:41:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4754, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "208.113.130.146", "classifications": [], "first_seen": { "$date": "2023-04-04T21:40:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:26:19Z" }, "ports": [ 45450, 34112, 55644, 34165, 33159, 47493, 50014, 36046, 37746, 36478, 56026, 54255, 54555, 59974 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 470, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "164.90.147.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T21:40:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T21:59:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2952, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "140.179.187.21", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:46:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20175, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.23.159", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:48:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13888, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.25.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:51:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 18182, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.222.246.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:58:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12827, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.95.189", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:08:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12326, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.106.229", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:41:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:04:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20353, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.84.170", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:41:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:04:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11757, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.234.255.58", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:41:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 21393, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.15.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:42:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:01:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14590, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.98.194", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:42:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:41:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11797, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.190.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:42:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:40:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15293, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.11.94", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:43:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:19:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20746, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.248.115", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:43:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16868, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.123.21", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:43:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:09:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14530, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.30.63", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:43:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:39:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15061, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.228.220", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:44:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:00:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14717, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.170.214", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:44:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:59:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 19921, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.98.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:44:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:45:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14694, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.247.237", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:44:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:11:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15979, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.12.20", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:44:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:00:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16399, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.51.55", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:43:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14836, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.39.12", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:54:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15597, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.27.2", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:46:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:46:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20144, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.224.142", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:46:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:30:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6189, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.176.167", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:46:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:48:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 19926, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.127.235", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:46:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:03:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16675, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.45.249", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:46:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:18:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16281, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.85.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:48:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 19716, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.207.220", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:48:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:52:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14278, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.74.55.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:49:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T21:49:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 428, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.79.41.60", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:52:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:59:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17883, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.83.96", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:52:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:02:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16762, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.235.133.180", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:52:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:52:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15163, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.165.117", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:54:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:03:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17321, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.26.216", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:55:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:56:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16178, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.13.213.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:56:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:50:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 444, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.82.18.112", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T21:58:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:59:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17456, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.250.135.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:00:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:00:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 408, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.79.52.241", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:00:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:00:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10924, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.235.129.186", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:00:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:56:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15039, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.224.19", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:00:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:10:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1060381, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.138.177.22", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T22:01:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:10:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1016, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "140.179.224.174", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:36:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3590, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.235.185.146", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:06:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:10:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5799, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.148.122.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:10:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:01:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 758, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.224.106", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:10:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:41:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4469, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.235.184.20", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:11:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:06:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 817899, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "3.8.77.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:12:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:48:51Z" }, "ports": [ 9082, 7117, 8587, 0 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 996, "tags": [ "tcp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "69.235.184.21", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:17:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:17:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6464, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "178.79.145.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:18:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:18:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 400, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.230.103", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:20:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:15:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 968316, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.235.184.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:21:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:37:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1076566, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.75.210.192", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:23:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:23:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "165.22.106.35", "classifications": [], "first_seen": { "$date": "2023-04-04T22:23:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:23:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 200, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.188.192.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:23:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:23:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 400, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.244.147.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T22:24:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:43:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1782, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "69.235.186.75", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:26:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:02:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1400617, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.163.206.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T22:27:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:39:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1585, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.210.206.65", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:29:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:29:00Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 597, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "39.98.186.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:30:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:16:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP PING BSDtype", "PROTOCOL-ICMP PING Unix", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1132, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "146.19.191.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:30:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:38:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2059, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.82.19.61", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:13:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1195, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.235.184.25", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:35:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:50:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 931449, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.248.192.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:39:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:49:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16376, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.235.184.30", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:41:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:20:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5657, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.240.187", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:44:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:28:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14083, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.186.153", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:30:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15287, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.188.21", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:00:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12583, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.84.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:46:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:04:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15391, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.67.209", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:47:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:00:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15119, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.167.221.126", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:47:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:20:00Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 174857, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "71.136.105.167", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:47:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:57:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8512, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "125.139.50.137", "classifications": [], "first_seen": { "$date": "2023-04-04T22:48:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:45:04Z" }, "ports": [ 10467, 38815, 58773, 31722 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 243, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "52.81.208.227", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:48:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:46:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 9857, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.117.60", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:35:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12240, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.2.215", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:50:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:55:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10175, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.46.166.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T22:50:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:08:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2460, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.177.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T22:51:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:07:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1893, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.179.244.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T22:51:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:09:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2079, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.188.30.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:52:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:10:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1724, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.215.234.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:53:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T20:37:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1344, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.81.105.123", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:53:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:51:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11071, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.154.29.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T22:54:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:09:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2259, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "71.137.2.231", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:54:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:04:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10152, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.107.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:54:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:35:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8048, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "157.52.220.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:55:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:45:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 388, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.141.78.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:56:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T22:56:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 384, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.136.116.77", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:56:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:01:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10851, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.63.176", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:57:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:59:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10254, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.26.124", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T22:57:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:45:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11596, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.87.63", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:00:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:57:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 19242, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.43.187", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:01:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:58:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10871, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.108.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:06:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:06:45Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 561, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "138.0.147.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:07:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:07:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.170.86.72", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-04T23:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:05:07Z" }, "ports": [ 445, 7000, 2080, 0, 1900 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 5802, "tags": [ "tcp", "smb", "icmp", "udp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.188.17.190", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:06:41Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1950, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "118.70.48.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:10:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:51:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5595, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.142.122.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:11:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:27:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1481, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.1.29.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:11:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:58:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5488, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.163.216.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:12:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:27:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1851, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "151.106.40.195", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:29:42Z" }, "ports": [ 5060, 0, 5080, 5070, 6050 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 582, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "207.120.8.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:14:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:29:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2221, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.210.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:14:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:27:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2221, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "69.235.187.238", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:15:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:11:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 7451, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.157.128.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:18:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:23:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 378, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.49.151.26", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-04-04T23:22:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:22:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-ICMP PING speedera", "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 925, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "141.98.11.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:24:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T21:07:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 814, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.34.163.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:30:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 736, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.69.74.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:47:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1648, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.254.114.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:32:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:51:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2554, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.176.78.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:33:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:50:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3093, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.195.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-04T23:35:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:46:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1465, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.189.6.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:35:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:44:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 806, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.86.127.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:39:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-04T23:39:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 368, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.136.101.137", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:45:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:55:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13205, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.222.200.154", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:49:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:57:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8105, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.20.26", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:49:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:58:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13102, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.103.98", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:51:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11538, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.101.2", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:52:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:42:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14662, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.105.251.80", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:54:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:10:38Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1056, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "71.136.101.61", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:54:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:57:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11386, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.74.163.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-04T23:58:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:07:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 788, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.235.132.139", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:01:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:46:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1075, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.224.152", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:05:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:21:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 912483, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.241.64", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:05:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:20:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14333, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.22.61.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:08:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:08:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 870, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "69.230.238.19", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:09:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:00:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14343, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.36.48", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:10:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:49:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11538, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.73.42", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:12:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:51:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12028, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.100.43", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:12:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:21:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13649, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.89.207.199", "classifications": [], "first_seen": { "$date": "2023-04-05T00:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:10:56Z" }, "ports": [ 57128, 42217, 37929, 52684, 57040, 58186, 48525, 34159, 55296, 56924 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 543, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.158.129.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T00:19:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:04:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5808, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "18.232.234.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T00:21:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4939, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.233.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T00:22:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:36:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 1339, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.82.35.253", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:22:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:51:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16469, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.28.239", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:27:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:51:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12597, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.88.241.90", "classifications": [ "Misc activity", "Detection of a Network Scan", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-04-05T00:34:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:31:42Z" }, "ports": [ 0, 1900, 1434, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "SQL ping attempt", "PROTOCOL-TFTP Get" ], "sightings": 1625, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "146.88.241.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:34:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:12:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 758, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.112.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:41:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:41:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 328, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.220.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T00:43:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:58:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1290, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.197.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:43:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 328, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.213.120.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T00:43:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:59:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1607, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.239.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T00:43:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:59:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1608, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.232.12.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T00:43:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:59:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1769, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.239.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:50:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:50:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 322, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.142.146.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:51:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:34:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1674, "tags": [ "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "3.249.92.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T00:55:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T00:55:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 320, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.218.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:04:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:17:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1402, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:14:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:16:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.100", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-04-05T01:14:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:20:32Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 1004, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.98.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:18:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:00:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1518, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.218.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:25:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:49:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3250, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.158.146.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:25:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:25:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 310, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.142.110.165", "classifications": [], "first_seen": { "$date": "2023-04-05T01:26:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:28:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 310, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "62.210.136.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:28:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:56:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 782, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.146.240.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:39:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:32:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 320, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.67.97.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T01:42:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:42:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 154, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.71", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:45:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:55:46Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1365, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "104.152.52.207", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-05T01:49:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T01:50:25Z" }, "ports": [ 0, 5060, 9999, 427, 162, 161, 1434, 53, 749, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch", "(port_scan) TCP portscan", "(port_scan) UDP portscan", "PROTOCOL-SNMP trap udp", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 23670, "tags": [ "icmp", "udp", "tcp", "snmptrap", "snmp" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "146.59.94.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T01:56:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:33:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 292, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.45.152", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:00:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:26:05Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 146, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "140.179.224.120", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:05:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 761923, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "86.104.194.220", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-05T02:14:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:45:55Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 500, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "163.172.118.156", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-04-05T02:15:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:21:25Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 940, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "128.199.17.229", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:15:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:48:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 294, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.70", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-05T02:21:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:55:54Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 678, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "146.88.241.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:33:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:46:30Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 926, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.136.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:00:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 280, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.239.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:44:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T01:43:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 270, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.250.203.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:46:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:46:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 260, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.178", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:47:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:20:13Z" }, "ports": [ 177, 0, 1434 ], "reporting_nodes": 1, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 1500, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.110.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:47:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:47:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 260, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.83.51.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T02:49:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:33:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1334, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.224.36.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T02:53:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:26:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1063, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.206.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T02:56:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T02:56:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 252, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.99.4.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T03:01:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:35:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1036, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.165.115.229", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T03:05:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:05:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 238, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.215.165.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T03:09:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:33:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 442, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.201.172.56", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T03:15:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:26:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 1519, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.135.8.131", "classifications": [], "first_seen": { "$date": "2023-04-05T03:21:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:37:35Z" }, "ports": [ 23558, 25388, 28030, 36867, 61400, 53757, 42575, 60367 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 169, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.243.21", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-05T03:22:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:57:28Z" }, "ports": [ 0, 162 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP trap tcp" ], "sightings": 223, "tags": [ "icmp", "tcp", "snmptrap" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.155.92.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T03:22:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:53:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 372, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.216.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T03:23:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:38:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.96.196.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T03:24:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T11:00:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 220, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.44.238.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T03:26:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:10:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 236, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.130", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-05T03:26:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:57:25Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 792, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.131.110.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T03:33:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:50:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1405, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.88.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T03:35:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:44:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 607, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "174.138.27.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T03:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:54:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 997, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.94.104.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T03:36:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:49:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1203, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.159.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T03:36:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:49:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 801, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.46.217.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T03:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:39:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 224, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.172.162.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T03:43:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T22:41:47Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 222, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.182.204.233", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-04-05T03:50:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:05:27Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 405, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "138.68.232.113", "classifications": [], "first_seen": { "$date": "2023-04-05T03:59:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T03:59:15Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 97, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "172.104.124.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:04:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:04:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 190, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.226.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:06:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:49:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 730, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.36.88.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:07:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:08:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 298, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.65.83.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:07:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:07:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 190, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.97.121", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:14:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:14:53Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 273, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "123.31.20.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T04:17:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:04:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2445, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "94.23.149.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T04:20:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:33:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 922, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "173.17.218.8", "classifications": [], "first_seen": { "$date": "2023-04-05T04:23:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:23:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 172, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "170.187.194.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:31:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:06:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 308, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "199.19.75.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:39:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:28:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 342, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.144.187.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:42:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:42:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 164, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.140.12.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:53:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:53:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.30", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-04-05T04:55:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:43:56Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 611, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "146.88.241.110", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-05T04:55:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:52:34Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 592, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.79.69.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T04:55:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T04:55:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 316, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.189.91.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T05:06:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:16:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.232.112.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T05:06:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:21:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 817, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.32.101.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T05:07:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:21:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 815, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T05:08:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:26:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 184, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.124.231.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T05:08:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:22:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 741, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.170.179.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T05:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:11:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.127.101.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T05:35:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:35:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.231.239.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T05:38:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:38:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.199.163.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T05:47:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:47:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.82.145.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T05:55:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:22:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 2212, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T05:57:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T05:57:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.43.160.127", "classifications": [], "first_seen": { "$date": "2023-04-05T05:58:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:21:58Z" }, "ports": [ 35393, 52168, 28238, 18902, 20941, 9200, 17160, 26096 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 116, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.91.168.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T06:02:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:04:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.210.161.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:07:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:26:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 838, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "24.236.91.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:09:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:56:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1950, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.85.252.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:12:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:26:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 698, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.50", "classifications": [ "Detection of a Network Scan", "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-04-05T06:19:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:50:15Z" }, "ports": [ 1900, 0, 111 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 605, "tags": [ "udp", "icmp", "sunrpc", "portmapper" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "103.12.199.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:25:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 580, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.102.200", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-04-05T06:27:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:27:25Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 207, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.60.22.240", "classifications": [], "first_seen": { "$date": "2023-04-05T06:30:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:12:39Z" }, "ports": [ 48127, 34485, 51775, 48816, 37670, 33819, 37127, 46629, 59320, 34086, 42663 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 139, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "27.124.5.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T06:35:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:35:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.189.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T06:35:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:35:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 128, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.63.108.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:39:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:56:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 535, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.64.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:40:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:53:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 478, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.169.26.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:40:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:28:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1672, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "80.68.7.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:41:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:56:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 648, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.55.64.140", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:42:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:06:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 533, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.232.12.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T06:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:55:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 648, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.139.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T06:44:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:09:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 188, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.179.93.137", "classifications": [], "first_seen": { "$date": "2023-04-05T06:50:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:52:01Z" }, "ports": [ 3333, 37443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 116, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.225.180.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T06:55:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T06:55:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 114, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.229.56.9", "classifications": [], "first_seen": { "$date": "2023-04-05T06:58:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:15:24Z" }, "ports": [ 39759, 60897, 54186, 59496, 51904, 33102, 46275 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 116, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "171.244.202.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T07:04:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:04:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.186.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T07:04:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:24:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 592, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.224.186.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:06:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:06:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 112, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.218.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T07:08:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:18:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 381, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.185.239.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:10:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:16:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 400, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.88.158.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T07:16:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:16:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.252.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:20:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:49:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3005, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.61.251.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:25:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:25:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.198.211.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:31:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:31:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 100, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.209.38.155", "classifications": [], "first_seen": { "$date": "2023-04-05T07:38:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:58:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 12598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "78.134.64.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T07:38:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:59:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 554, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.67.75.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:40:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:26:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 490, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.26.8.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:41:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:16:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 320, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.26.9.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:41:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:47:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.96.127.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T07:41:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1339, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.36.80.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:43:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:43:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.135.36.66", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-04-05T07:43:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:43:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-ICMP PING Windows", "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 322, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "162.243.132.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:43:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:43:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.192.96.238", "classifications": [], "first_seen": { "$date": "2023-04-05T07:45:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:22:00Z" }, "ports": [ 20648, 35268, 20702, 30149, 33133, 49409 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 102, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.224.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T07:45:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T07:45:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.160.80.186", "classifications": [], "first_seen": { "$date": "2023-04-05T07:45:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:36:10Z" }, "ports": [ 37969, 37292, 57379, 38436 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 76, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "27.124.32.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:02:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:02:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.189.7.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T08:11:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:55:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 552, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.221.27.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T08:12:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:27:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 385, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.232.136.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T08:12:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:27:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 469, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.74.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T08:13:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:28:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 426, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "84.38.182.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T08:14:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:21:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 306, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.198.193.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:15:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:15:31Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 132, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "34.90.72.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:18:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:18:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 88, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.138.46.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:22:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:20:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.20.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:29:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:56:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8291, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.200.61.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T08:34:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:34:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 41, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.16.21", "classifications": [], "first_seen": { "$date": "2023-04-05T08:37:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:25:35Z" }, "ports": [ 443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 46, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.196.156.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:46:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:01:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 162, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.143.129.95", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-05T08:53:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:58:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 280, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "185.200.116.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:55:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:06:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.239.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:55:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:55:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.124.5.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T08:56:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T08:56:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "207.46.227.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T09:03:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:11:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46, "tags": [ "tcp", "ssh", "libssh-0.6.3" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.224.186.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T09:04:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:04:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.194.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T09:04:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:22:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 334, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.238.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T09:10:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T23:06:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 110, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.93.209.213", "classifications": [], "first_seen": { "$date": "2023-04-05T09:11:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:23:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 130, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "27.124.32.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T09:16:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:16:38Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 111, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "202.95.12.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T09:24:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:24:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.137.20.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T09:38:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:38:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "120.210.206.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T09:42:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:18:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 209, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "3.77.23.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T09:42:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T11:10:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.220.228.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T09:44:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T09:44:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.124.32.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:00:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:00:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 68, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.210.200.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T10:01:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:40:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 955, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.168.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T10:05:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:20:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 325, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.198.59.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:09:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:25:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 168, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.181.242.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:11:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:11:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 65, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.179.193.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T10:17:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:33:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 406, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.178.172.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:18:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:41:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 266, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.192.5.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:20:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:25:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 88, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:23:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:23:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.83.154.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:26:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:26:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.124.5.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:29:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:29:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.249.171.214", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-05T10:30:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:15:14Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 170, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.232.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:34:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:09:53Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 2969, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "51.222.209.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:35:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:35:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.17.133.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T10:42:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:57:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 235, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.44.137.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T10:43:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:59:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 351, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.172.79.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T10:46:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:58:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 263, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.232.11.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T10:46:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:59:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 350, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.41.23.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:47:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T10:47:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.220.228.88", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:54:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:50:08Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 135, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "27.124.5.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T10:59:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:30:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 96, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.220.228.83", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-04-05T11:06:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:06:10Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 87, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "206.55.65.229", "classifications": [], "first_seen": { "$date": "2023-04-05T11:09:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:33:16Z" }, "ports": [ 57355, 58546, 37627, 41334, 37912, 58092, 43084, 40992, 52354, 48551, 56859, 42121, 36164, 44639 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 75, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.225.163.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T11:09:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:09:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 58, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.224.223.225", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-05T11:09:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:10:03Z" }, "ports": [ 23, 161, 2658, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 116, "tags": [ "tcp", "telnet", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "44.211.11.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T11:10:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:10:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 29, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.210.228.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T11:13:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:22:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 203, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.195.123.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T11:16:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:21:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 87, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.248.165.23", "classifications": [], "first_seen": { "$date": "2023-04-05T11:17:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:18:47Z" }, "ports": [ 31433, 21433 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 58, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.162.16.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T11:25:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:00:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 86, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.189.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T11:25:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:25:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 58, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.124.5.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T11:40:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:40:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 58, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.161.57.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T11:43:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:57:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 232, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.163.192.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T11:43:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:55:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 261, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.190.128.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T11:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T11:53:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 203, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.95.12.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T11:48:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:01:36Z" }, "ports": [ 0, 7001 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "POLICY-OTHER AFS access" ], "sightings": 115, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "217.147.1.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T11:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:42:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 910, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.11.21", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:07:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T00:49:54Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 228, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.235.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:13:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:13:28Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.93.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:14:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:14:02Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "103.61.113.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:17:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:17:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.159.251.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:37:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:37:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.225.180.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:38:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:38:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.183.11", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:42:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:17:08Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 180, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.138.218.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:43:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:55:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.198.211.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T12:55:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T12:55:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "156.251.172.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T13:12:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:12:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 45, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.130.81.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T13:18:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:24:04Z" }, "ports": [ 1521, 0 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 325, "tags": [ "tcp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.173.130.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T13:37:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:51:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 152, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.69.36.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T13:37:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:52:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 190, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "223.27.146.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T13:39:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:51:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 133, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.139.13.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T13:39:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:39:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "132.226.7.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T13:39:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:50:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 95, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.254.229.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T13:47:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:47:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.189.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T13:47:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T13:47:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.196.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:01:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:56:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 86, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.177.186.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:01:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:32:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 68, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.95.12.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:03:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:03:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.76", "classifications": [], "first_seen": { "$date": "2023-04-05T14:03:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:03:59Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 19, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "202.95.12.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:04:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:04:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.34.18.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T14:10:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:37:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.126.62.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T14:19:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:21:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 76, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.124.32.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:28:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:28:52Z" }, "ports": [ 7001, 0 ], "reporting_nodes": 1, "rules": [ "POLICY-OTHER AFS access", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 57, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.224.186.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:32:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:32:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.189.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:38:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:06:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 64, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.121.61.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:49:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:49:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.161.7.110", "classifications": [], "first_seen": { "$date": "2023-04-05T14:49:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:49:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 72, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "60.216.0.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T14:53:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T14:53:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.134.4.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T14:59:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:00:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.139", "classifications": [], "first_seen": { "$date": "2023-04-05T15:05:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:06:45Z" }, "ports": [ 54321, 3372, 33998, 47903 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 38, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.224.186.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:05:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:05:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.95.12.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:05:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:05:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.239.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:07:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:44:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "20.25.79.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:09:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:18:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 119, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.148.19.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:09:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:24:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 132, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.209.104.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:09:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:27:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 131, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.199.223.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:10:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:26:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 148, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.181.112.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:13:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:30:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 113, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.214.73.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:15:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:01:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 481, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.156.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:16:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:29:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 113, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.115.104.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:20:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.225.163.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:28:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:28:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.173.165.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:39:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:39:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.110.159.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:05:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 78, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.42.92.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:52:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:52:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.123.253.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T15:55:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T15:55:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.146.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:55:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:05:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 140, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.51.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:57:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:12:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 136, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.119.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T15:59:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:10:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 136, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.224.186.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:03:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:03:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.168.68.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:09:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:58:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.140.146.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:11:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:11:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Network Unreachable" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.237.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:17:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:04:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.216.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:19:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:19:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.187.179.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:28:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:29:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:47:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 548, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "114.96.145.49", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:30:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:30:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 75, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "27.124.5.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:32:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:32:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.225.180.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:36:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.204.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:36:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.139", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:46:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T16:46:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "142.132.158.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:46:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:32:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 270, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.159.200.123", "classifications": [], "first_seen": { "$date": "2023-04-05T16:58:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:12:56Z" }, "ports": [ 51410, 39302, 47540, 59865, 59535, 45993, 35080, 59033, 34656, 55149, 46978, 42065, 36482 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 65, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "66.94.111.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T16:59:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T19:08:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.241.121.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T16:59:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:10:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "83.151.204.124", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:01:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:43:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 405, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "52.81.201.102", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:01:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:06:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3399, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.112.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:02:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:15:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4692, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.63.154", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:02:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:17:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4853, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "203.129.220.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:02:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:46:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 404, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.105.6.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:06:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:34:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.235.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:15:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:15:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.107.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:17:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:54:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "132.226.123.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:17:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:17:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.182.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:20:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:36:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 131, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "99.242.130.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:23:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:23:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.16.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:33:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 117, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "52.81.34.195", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:24:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:38:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 260, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "88.80.189.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:25:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T20:21:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.136.103.83", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3842, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.96.53", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:46:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3693, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.173.24", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:06:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 325, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.38.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:26:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3281, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.98.31", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:28:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:04:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3780, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.46.32", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:28:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:49:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3636, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "136.158.28.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:30:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:30:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.97.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:30:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3829, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.170.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:18:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3598, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.69.165", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:43:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3550, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.77.239", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:46:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3999, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.118.31", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:02:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3576, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.235.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:33:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3670, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.69.251", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:33:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:33:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 65, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.82.190", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:35:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:22:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3227, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.125.224", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:36:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3741, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.77.235", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:49:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3500, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.67.169", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:44:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3667, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.97.112", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:39:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:19:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3375, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.168.85", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:43:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:43:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3306, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.196.11.81", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T17:43:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:09:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3719, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "177.101.109.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:47:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:02:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.251.247.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:47:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:03:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.93.142.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:52:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T17:57:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.104.184.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:53:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:48:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 380, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.184.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:54:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:03:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 91, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.236.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:56:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:08:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 104, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.139.58.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:59:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:38:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 635, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.67.93.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T17:59:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T19:03:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(ssh) payload size incorrect for the given payload" ], "sightings": 37, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.81.103.124", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:05:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:44:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3505, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.234.191", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:05:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:23:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3991, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.50.210", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:15:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3348, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.105.107.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:53:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.86.144.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:06:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.136.115.28", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:13:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3595, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.76.245", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:20:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3874, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.96.60", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:21:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2929, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "27.124.5.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:08:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.222.183.6", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:08:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:16:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3329, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.178.124", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:08:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3521, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.167.63", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:10:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:57:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3414, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.70.22", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:10:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:17:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3329, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.187.121", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:10:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:46:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3587, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.206.114", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:10:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:11:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3520, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.24.88", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:12:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:22:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4264, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.137.2.118", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:13:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:44:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3645, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.95.220", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:15:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:45:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4031, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.132.10.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T18:15:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:16:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.110.39", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:20:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:10:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3532, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.86.240", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:23:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:16:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3348, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.33.47", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:23:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:17:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4988, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.116.104", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:23:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:19:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4591, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.38.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:23:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:12:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4395, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.131.86", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:24:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:15:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4272, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.235.140.90", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:24:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4460, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.14.233", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:25:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:17:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4516, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.48.21", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:25:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:20:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4702, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.14.207", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:27:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:14:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3643, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.231.138.235", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:27:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:20:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4682, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.46.63", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:27:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:04:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4559, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.247.0", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:27:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:15:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5071, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.17.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:27:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:20:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4817, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.93.128", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:28:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:08:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4781, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.68.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:28:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:11:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4003, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.34.172", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:30:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:23:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4054, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.18.54", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:30:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:11:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4354, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.49.78", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:32:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:15:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3811, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.54.90", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:33:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:21:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4606, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.208.96", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:04:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4620, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.116.130", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:08:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4771, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.7.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:14:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4354, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.140.54", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:24:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4735, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.42.147", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:36:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:23:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4382, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.187.176.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:37:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:37:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.80.188.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:37:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:44:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.189.226.25", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:16:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3761, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.97.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:12:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4781, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.205.67", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:42:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:10:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4654, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.4.236", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:42:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:23:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4301, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.81.163", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:42:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:02:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3934, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "18.229.64.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:45:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:45:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.192.49.73", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:45:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:19:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4687, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.75.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:47:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:12:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4613, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.25.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:48:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:05:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4148, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "81.219.48.0", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:48:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T18:48:57Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 132, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.244.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:48:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3926, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.126.66", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:50:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:07:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4581, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.50.236", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:51:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:24:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4833, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "88.80.188.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:54:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:24:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.189.80.89", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T18:56:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:24:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4514, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.18.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T19:06:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:14:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3420, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "3.83.138.198", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-05T19:10:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T19:11:04Z" }, "ports": [ 135, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 33, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "71.131.204.51", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T19:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:06:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3558, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.184.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T19:24:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:21:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3156, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "8.219.247.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T19:46:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T19:54:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 80, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.189.226.252", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T19:49:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:06:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4511, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "178.238.212.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T20:13:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T11:19:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 680, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.135.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T20:20:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:21:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window", "SSH Login Attempts", "(ssh) payload size incorrect for the given payload" ], "sightings": 40, "tags": [ "tcp", "ssh", "brute_force" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "43.156.239.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T20:25:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T20:25:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.89.68.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T20:31:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T20:31:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.25.118.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T20:31:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:47:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.237.96.50", "classifications": [], "first_seen": { "$date": "2023-04-05T20:35:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:56:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 13554, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "74.50.90.134", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-05T20:35:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:42:03Z" }, "ports": [ 5080, 0, 5062, 6060, 5060, 5960 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "165.22.217.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T20:44:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:14:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 92, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.119.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T20:44:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T20:47:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.75.161.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T20:58:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:11:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 100, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.92.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T21:08:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:11:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.209.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T21:15:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:15:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24673, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.112.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T21:19:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:19:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.186.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T21:29:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:29:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.14.63.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T21:29:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:53:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.131.32.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T21:36:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:36:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.178.4.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T21:37:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:51:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 210, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "69.230.237.96", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T21:47:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:19:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4583, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.246.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T21:54:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T21:54:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.18.73.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T22:14:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:09:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 274, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.136.48.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T22:27:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T22:27:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.26.51.234", "classifications": [], "first_seen": { "$date": "2023-04-05T22:35:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:40:10Z" }, "ports": [ 14332, 14330, 14433 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 16, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.236.116.147", "classifications": [], "first_seen": { "$date": "2023-04-05T22:52:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:43:34Z" }, "ports": [ 35314, 36853, 35260, 36147, 56094, 55571 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 26, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.59.92.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T22:53:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T22:53:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.54.59.166", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-05T22:57:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:05:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "123.232.38.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T23:00:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T23:00:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.75.164.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T23:13:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:50:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.185.234.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T23:38:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T23:38:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.116.24.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T23:42:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T23:42:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.1.42.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T23:46:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:40:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 270, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.59.176.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-05T23:49:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-05T23:49:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.103.240.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-05T23:50:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:33:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 270, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.210.75.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T00:13:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:13:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.210.107.80", "classifications": [], "first_seen": { "$date": "2023-04-06T00:18:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:41:35Z" }, "ports": [ 8883, 443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 17, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.158.142.114", "classifications": [], "first_seen": { "$date": "2023-04-06T00:35:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:54:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "151.106.38.125", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-06T00:36:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T18:16:14Z" }, "ports": [ 5060, 0, 5080, 6050, 6060, 6061, 5070, 5090, 5050 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 111, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "121.149.93.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T00:47:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T00:47:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.252.135.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T00:51:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:05:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.117", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-06T01:17:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:22:10Z" }, "ports": [ 0, 177 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "X11 xdmcp info query" ], "sightings": 780, "tags": [ "icmp", "udp", "xdmcp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "139.162.2.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T01:26:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:46:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.237.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T01:32:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:32:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.144.187.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T01:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T01:43:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.133.56.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T01:54:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:07:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.196.176.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T02:04:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:20:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 126, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.132.78.109", "classifications": [], "first_seen": { "$date": "2023-04-06T02:23:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:23:05Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 9, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.149.109.128", "classifications": [], "first_seen": { "$date": "2023-04-06T02:23:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:23:05Z" }, "ports": [ 32795 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 9, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.239.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T02:24:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:51:38Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "185.133.252.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T02:49:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:49:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.135.226.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T02:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T02:56:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.242.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T02:58:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:14:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 72, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.229.0.50", "classifications": [], "first_seen": { "$date": "2023-04-06T03:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:07:21Z" }, "ports": [ 41069, 51772, 43508, 57169, 53506, 36389, 57442, 41397 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 36, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.54.34.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T03:02:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:15:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.237.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T03:03:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:15:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 99, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.187.243.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T03:04:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:04:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.34.55.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T03:06:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:07:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.48.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T03:10:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:10:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.237.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T03:19:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T02:46:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.164.82.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T03:22:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:42:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.168.43.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T03:33:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T03:33:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T03:49:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:28:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.127.54.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T03:54:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:10:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25866, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.70.69.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T04:19:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:19:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.44.238.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T04:35:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:35:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.6.6.234", "classifications": [], "first_seen": { "$date": "2023-04-06T04:36:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:36:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "207.134.193.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T04:38:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T04:38:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.249.198.54", "classifications": [ "Attempted Information Leak", "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-06T04:38:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:21:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-ICMP superscan echo", "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 70, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "104.223.37.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T04:46:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:47:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.135.74.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T04:49:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:51:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 96, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.159.121.164", "classifications": [], "first_seen": { "$date": "2023-04-06T05:02:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:15:11Z" }, "ports": [ 12410, 6094, 3787 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 28, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.67.192.34", "classifications": [], "first_seen": { "$date": "2023-04-06T05:06:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:06:10Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 8, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.134.42.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T05:06:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:19:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.93.63.135", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-06T05:12:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:12:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.250.11.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T05:13:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:24:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 64, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.49.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T05:14:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:56:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8034, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.99.192.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T05:19:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:19:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.93.75.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T05:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:21:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 232, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.122.233.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T05:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:40:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.221.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T05:33:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T05:33:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.28.206.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T05:49:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:30:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.28.206.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T05:56:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:42:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.222.41.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T06:00:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:00:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.33.27.40", "classifications": [], "first_seen": { "$date": "2023-04-06T06:04:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:35:56Z" }, "ports": [ 36095, 58852, 561 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 31, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "213.60.211.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T06:17:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:26:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.22.202.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T06:26:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:26:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T06:31:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:14:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 696, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.188.16.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T06:44:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T06:46:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.54.238.169", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-04-06T07:03:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:40:07Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.99.133.244", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-06T07:03:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:26:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2755, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.204.16", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-06T07:07:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:09:36Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 580, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "193.123.77.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-06T07:16:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:14:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 135, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "119.246.15.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T07:21:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T07:21:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.138", "classifications": [], "first_seen": { "$date": "2023-04-06T07:28:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:54:36Z" }, "ports": [ 6000, 3403, 3444, 3303 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 20, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "37.139.30.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T07:34:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T07:49:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 80, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.254.235.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T07:39:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T07:51:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 64, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.10.57.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T07:41:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T07:41:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.113.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T07:43:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:40:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.2.53.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T07:46:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:07:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 330, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.162.13.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T07:47:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T07:47:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.230.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T07:48:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:03:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.163.206.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T07:53:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:16:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 96, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.153.141.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T07:55:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:22:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 224944, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "217.106.5.142", "classifications": [], "first_seen": { "$date": "2023-04-06T08:10:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:10:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "218.24.105.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T08:11:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:11:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.168.58.41", "classifications": [ "Misc activity", "Information Leak", "Attempted Information Leak", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-04-06T08:12:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:12:47Z" }, "ports": [ 0, 25, 7001, 161, 162, 53, 69 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-ICMP PING Unix", "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP Echo Reply", "(port_scan) TCP portscan", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "POLICY-OTHER AFS access", "(port_scan) UDP portscan", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP trap udp", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-DNS Malformed DNS query with HTTP content" ], "sightings": 384, "tags": [ "icmp", "tcp", "udp", "snmp", "snmptrap", "tftp" ], "rule_count": 14, "classification_count": 4 }, { "ioc": "103.56.61.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T08:18:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:05:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.134.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T08:46:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T08:46:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.163.212.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:46:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.62.99.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:03:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:03:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.74.235.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T09:04:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:06:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.118.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:05:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:43:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "83.239.227.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:05:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:05:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.109.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:08:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:08:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.37.115.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:23:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:23:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.194.98.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:23:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:23:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.239.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:25:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:25:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.123.114.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T09:45:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T09:45:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.232.10.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T09:50:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:07:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T10:01:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:52:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 118, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.183.228.52", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T10:09:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:10:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.240.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T10:13:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:38:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.138.169.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T10:20:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:32:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.178.120.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T10:21:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:00:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 74, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T10:26:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:26:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.239.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T10:35:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:35:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.208.3.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T10:42:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:26:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.4.200.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T10:43:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T10:43:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T10:56:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:42:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.218.185.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T10:58:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:10:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8110, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.210.100.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T11:17:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:03:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 198, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.176.25.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T11:18:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:18:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.195.21.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T11:21:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:21:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.44.241.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T11:27:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:27:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.227.167.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T11:36:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:52:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.27.114.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T11:39:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:57:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 72, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "88.204.221.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T11:40:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:20:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 150, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.184.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T11:49:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:01:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.233.206.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T11:52:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T11:59:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.20.85", "classifications": [ "Potentially Bad Traffic", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-06T11:59:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:39:39Z" }, "ports": [ 69, 0, 1434, 177 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "X11 xdmcp info query" ], "sightings": 20786, "tags": [ "udp", "tftp", "icmp", "xdmcp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "189.244.48.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T12:00:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:45:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 144, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.66.212.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T12:00:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:16:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 54, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.102.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T12:02:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:16:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "197.243.104.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T12:02:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:17:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.186.87.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T12:08:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:08:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.231.81", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-04-06T12:11:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:11:04Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "138.185.172.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T12:37:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T08:06:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.229.85.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T12:47:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:15:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 96, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.165.230", "classifications": [], "first_seen": { "$date": "2023-04-06T12:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T12:57:15Z" }, "ports": [ 5016, 5029 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 12, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.92.7.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T12:56:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:38:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.52.232.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T13:06:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:23:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.5.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T13:06:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:21:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 98, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "58.246.77.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T13:25:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:39:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.211.205", "classifications": [], "first_seen": { "$date": "2023-04-06T13:30:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:30:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.142.146.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T13:32:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:32:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.76.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T13:35:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:45:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1412, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.149.163.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T13:55:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T13:55:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.248.136.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T13:58:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T14:13:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.54.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T14:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T14:09:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.49.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T14:02:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T14:12:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.10.22.83", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-04-06T14:10:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T14:13:10Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.156.240.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T14:25:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:10:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.57", "classifications": [], "first_seen": { "$date": "2023-04-06T14:30:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T14:30:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.13.31.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T14:53:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:32:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.137.206.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T15:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:19:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.99.52.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T15:06:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:20:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.248.133.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T15:09:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:09:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.17.22.90", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-04-06T15:16:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:59:40Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 88, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "141.255.166.106", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-04-06T15:20:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:17:41Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 94, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "189.195.223.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T15:23:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:27:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 78, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.152.52.234", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-06T15:24:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:25:16Z" }, "ports": [ 0, 1646, 137, 2049, 1900, 53, 5060, 162, 161, 9 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) TCP portscan", "(port_scan) UDP portscan", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt", "(sip) content length mismatch", "PROTOCOL-SNMP trap udp", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 918, "tags": [ "icmp", "tcp", "udp", "snmptrap", "snmp" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "113.88.209.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T15:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:24:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.144.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T15:26:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:26:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.10.61.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T15:29:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:29:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T15:33:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:34:12Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "161.97.83.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T15:33:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:33:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.155.16.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T15:38:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:38:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.145.236.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T15:39:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:39:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "158.101.155.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T15:44:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:01:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.24.47.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T15:50:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:05:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.213.135.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T15:56:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T15:56:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.210.100.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T16:00:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:13:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 72, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.194.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T16:05:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:19:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.216.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:08:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.171.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:08:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.91.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T16:11:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:11:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.241.12.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T16:11:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:11:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.87.204.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T16:28:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:06:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.13.105.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T16:44:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T16:44:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.95.21.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T17:02:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:02:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.92.63.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T17:23:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:03:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.114.175.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T17:37:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:37:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.155.172.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T17:41:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:57:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.22.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T17:46:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:58:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.226.79.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T17:47:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T17:56:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.128.246.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T18:21:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:50:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "208.115.210.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T18:22:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T21:07:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.252.85.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T18:34:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:34:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.22.168.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T18:46:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:35:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.21.129.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T18:56:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T18:56:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.164.236.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T18:59:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:00:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.135.169.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T19:05:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:05:55Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.26.95.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T19:25:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:25:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.161.19.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T19:28:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:32:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.98.73.87", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-06T19:33:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:52:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 27960, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "221.161.30.154", "classifications": [], "first_seen": { "$date": "2023-04-06T19:40:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:40:07Z" }, "ports": [ 53858 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 5, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.100.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T19:54:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:00:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "44.211.252.83", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-06T19:54:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:54:24Z" }, "ports": [ 111, 162, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 15, "tags": [ "tcp", "sunrpc", "portmapper", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "44.203.56.28", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-06T19:54:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T19:54:47Z" }, "ports": [ 161, 2087, 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp", "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp" ], "sightings": 15, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "54.242.170.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T19:55:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:23:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.225.70.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T19:56:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:27:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.104.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T20:08:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T20:08:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.185.238.67", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-06T20:10:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:34:59Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 80, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "191.252.184.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T20:26:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:15:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44656, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.156.149.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T20:33:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T20:33:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.103.90.48", "classifications": [], "first_seen": { "$date": "2023-04-06T20:40:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:22:49Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 644, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.212.157.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T20:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T20:44:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.159.153.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T20:44:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:50:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.132.109.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T20:50:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:46:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.66.68.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T21:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T21:11:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.139.69.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T21:20:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T21:20:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.89.179.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T21:32:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T21:33:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T21:57:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T21:57:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.237.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T22:16:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:32:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.126.143.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T22:22:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T22:22:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.165.81", "classifications": [], "first_seen": { "$date": "2023-04-06T22:34:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:38:26Z" }, "ports": [ 5050, 5092, 6015, 6076, 6017, 6057 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 20, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.210.187.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T22:36:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T22:54:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.108.143.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T22:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T22:51:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.45.17.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T22:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:32:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 75, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "207.249.96.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T22:40:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T22:49:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.206.243.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T22:44:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:32:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.228.245.255", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T22:45:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T22:45:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.97.100", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-06T22:50:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T22:50:07Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "211.5.131.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T22:51:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T22:51:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.195.251.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T23:05:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:58:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window", "(stream_tcp) reset outside window" ], "sightings": 205, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "159.203.113.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T23:06:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:19:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "144.92.201.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T23:10:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:10:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.225.159.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-06T23:10:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:22:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "120.245.20.118", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-06T23:18:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:18:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 25, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "195.178.120.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T23:20:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:24:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.99.253.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T23:24:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:24:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.143.9.98", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-04-06T23:24:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:27:22Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 170, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "85.233.65.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T23:25:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:25:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 25, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "177.221.141.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-06T23:27:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-06T23:27:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.94.178.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T00:14:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T00:14:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.4.25.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T00:29:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T00:29:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.225.4.210", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T00:45:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T00:45:44Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.59.98.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:48:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:03:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.90.144.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:50:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:05:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "213.32.82.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:50:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:00:22Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 73, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.141.58.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:51:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:03:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.93.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:51:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:05:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.209.85.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:51:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:17:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1169, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.136.217.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:51:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:48:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 136, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.123.192.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:52:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T00:53:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.104.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T00:53:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:03:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.143.131.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T01:01:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:45:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 134, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.69.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T01:02:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:52:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "153.92.223.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T01:04:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:17:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "66.63.177.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T01:08:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:17:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 108, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.176.2.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T01:10:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:16:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.108.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T01:11:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:25:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.183.62.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T01:11:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:34:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.112.187.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T01:13:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:29:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.232.11.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T01:15:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:27:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.88.238.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T01:18:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T01:18:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.169.63.180", "classifications": [], "first_seen": { "$date": "2023-04-07T01:38:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:33:20Z" }, "ports": [ 41317, 37073, 44456, 32976 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 15, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.89.98.193", "classifications": [], "first_seen": { "$date": "2023-04-07T02:05:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T02:05:08Z" }, "ports": [ 2023 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "149.18.73.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T02:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:38:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.42.92.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T02:09:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:49:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.32.206.103", "classifications": [], "first_seen": { "$date": "2023-04-07T02:10:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T02:10:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.197.219.1", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T02:39:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T02:39:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.224.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T02:45:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T02:45:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.244.144.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T02:56:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:08:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "158.51.121.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T03:12:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:12:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.164.255.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T03:22:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:22:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "192.241.210.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T03:22:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:22:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.135.180.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T03:31:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:31:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.200.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T03:35:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:00:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.135.192.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T03:36:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:36:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.100.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T03:47:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T03:47:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.182.71.128", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T04:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:08:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.195.215.184", "classifications": [], "first_seen": { "$date": "2023-04-07T04:10:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:37:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "112.238.11.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T04:16:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:16:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.135.227.154", "classifications": [], "first_seen": { "$date": "2023-04-07T04:21:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:45:40Z" }, "ports": [ 21452 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 7, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "176.10.254.83", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T04:22:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:23:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "42.96.46.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T04:27:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:38:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.156.247.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T04:41:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T04:58:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.197.102.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T04:44:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:53:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 70, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.188.30.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T04:49:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:25:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 68, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.248.93.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T05:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:23:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.44.223.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T05:17:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:33:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.137.138.225", "classifications": [], "first_seen": { "$date": "2023-04-07T05:20:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:20:55Z" }, "ports": [ 6583 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.159.139.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T05:30:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:30:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.148.119.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T05:39:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:41:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.148.119.126", "classifications": [], "first_seen": { "$date": "2023-04-07T05:40:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T05:40:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "82.170.97.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:00:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:00:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.12.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:03:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:16:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.141.53.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:04:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:21:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "182.74.47.252", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:08:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:57:15Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 76, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.106.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:09:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:22:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.176.112.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:09:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:21:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.143.16.204", "classifications": [], "first_seen": { "$date": "2023-04-07T06:12:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:12:57Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 8, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.152.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T06:23:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:18:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.104.194.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T06:27:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:27:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.152.29.126", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T06:32:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:29:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8500, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.159.129.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:33:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:51:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.126.234.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:34:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:34:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.158.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:34:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:50:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.149.14.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:36:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:53:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "36.139.87.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T06:40:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T06:40:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.185.123.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T06:49:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T18:07:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.167.243.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T07:18:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T07:37:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.85.80.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T07:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:04:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.136.225.42", "classifications": [ "Misc activity", "Attempted Information Leak", "Potentially Bad Traffic", "Decode of an RPC Query", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-07T07:41:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:11:50Z" }, "ports": [ 0, 161, 177, 69, 1434, 162, 111, 53, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "X11 xdmcp info query", "PROTOCOL-TFTP NULL command attempt", "PROTOCOL-TFTP Get", "SQL ping attempt", "PROTOCOL-SNMP trap udp", "PROTOCOL-RPC portmap listing UDP 111", "PROTOCOL-DNS named version attempt", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 1114978, "tags": [ "icmp", "udp", "snmp", "xdmcp", "tftp", "snmptrap", "sunrpc", "portmapper" ], "rule_count": 12, "classification_count": 5 }, { "ioc": "92.63.196.142", "classifications": [], "first_seen": { "$date": "2023-04-07T07:59:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T07:59:45Z" }, "ports": [ 49543 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.235.82.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T08:12:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T08:12:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.188.192.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T08:20:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:57:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.237.133.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T08:27:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T08:58:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.143.129.88", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T08:34:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:56:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 48533, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.15.11.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T08:43:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:39:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32759, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T08:51:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T08:51:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.201.63.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T09:09:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:31:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "64.188.30.98", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-07T09:28:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:27:18Z" }, "ports": [ 65476, 0, 5060 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 78, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "178.223.24.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T09:29:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:29:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.157.215.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T09:31:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:31:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.91.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T09:35:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:50:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "42.194.146.237", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T09:37:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:37:44Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "13.87.204.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T09:39:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:51:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.145.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T09:41:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:58:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.132.109.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T09:44:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:07:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "60.25.12.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T09:45:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:04:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 96, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.156.239.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T09:45:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T09:45:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.79.93.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T09:58:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:44:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.143.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T10:12:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:18:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.185.137.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T10:24:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T10:34:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.101.95.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T10:26:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:07:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 76, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.224.16", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T10:42:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:14:04Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "tcp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "202.137.112.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T11:02:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:02:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.237.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T11:25:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T11:25:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.201.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T11:30:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:36:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.212.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T11:31:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:31:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.252.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T12:10:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:10:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.140.146.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T12:16:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:29:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2863, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.210.123.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T12:43:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:55:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2265, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.16.115.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T12:48:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:48:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.158.22.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T12:54:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T12:54:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.38.80.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T13:00:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:14:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "92.53.18.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T13:06:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:06:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.238.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T13:20:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:24:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.99.133.240", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-07T13:22:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:57:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 60560, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "112.187.190.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T13:59:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T13:59:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.84.64.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T14:05:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:05:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.31.222.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T14:06:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:06:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.102.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T14:06:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:28:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T14:07:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:15:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.251.147.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T14:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:04:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.139.83.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T14:20:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:20:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.171.240.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T14:41:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:41:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.214.84.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T14:53:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:53:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.133.56.235", "classifications": [], "first_seen": { "$date": "2023-04-07T14:55:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:55:04Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "144.22.196.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T14:58:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T14:58:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.10.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T15:24:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:40:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.165.87.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T15:26:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:26:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.128.75.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T15:27:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:43:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.241.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T15:30:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:52:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.225.16.64", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T15:32:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:32:06Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "175.213.180.88", "classifications": [], "first_seen": { "$date": "2023-04-07T15:32:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:32:42Z" }, "ports": [ 44241 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 3, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.34.117.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T15:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:43:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.53.94.150", "classifications": [], "first_seen": { "$date": "2023-04-07T15:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T15:51:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 213, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "125.133.181.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T15:54:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:52:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.84.56.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T16:02:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:02:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.203.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:03:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:16:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "133.175.101.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:04:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:04:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "93.114.82.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:24:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:34:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:48:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:36:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19454, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.85.69.141", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:51:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:51:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.236.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:55:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:06:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.135.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:57:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:57:27Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.74.38.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:57:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:47:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1954, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.235.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T16:59:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T16:59:17Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.201.24.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T17:07:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T17:07:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.54.143.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T17:13:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:05:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.226.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T17:15:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T17:15:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.36.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T17:42:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:46:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1404, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.170", "classifications": [], "first_seen": { "$date": "2023-04-07T17:49:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T17:49:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.234.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T17:54:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T17:54:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.128.13", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-07T18:10:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:15:29Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 30, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "118.193.103.197", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T18:14:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:26:10Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "134.65.232.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T18:25:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T18:25:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.190.72.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T18:35:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T18:35:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T19:12:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:45:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18794, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.180.143.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T19:32:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T19:32:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.111.209.2", "classifications": [], "first_seen": { "$date": "2023-04-07T19:37:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T19:37:25Z" }, "ports": [ 389 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 3, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.70.247.247", "classifications": [], "first_seen": { "$date": "2023-04-07T20:01:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:12:21Z" }, "ports": [ 64441, 62254 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 8, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.73.102.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T20:01:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:36:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 69, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.223.219.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T20:02:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:18:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 180, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "217.29.49.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T20:03:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:17:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.94.138.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T20:03:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:00:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.221.239.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T20:10:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:29:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "81.17.22.122", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-04-07T20:10:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:02:40Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 24, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "27.72.116.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T20:14:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T21:04:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.211.121.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T20:29:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:19:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 114, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.197.141.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T20:31:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:47:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.83.79.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T20:33:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:39:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.132.145.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T20:44:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:44:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.244.11", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T20:57:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T20:57:47Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.206.228", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T21:00:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T21:00:28Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.200.118.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T21:07:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T21:44:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.155.17.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T21:35:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T21:35:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.239.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T21:47:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T21:47:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "44.201.252.100", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-07T22:21:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:21:20Z" }, "ports": [ 22, 162, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP trap tcp", "PROTOCOL-SNMP request tcp" ], "sightings": 9, "tags": [ "tcp", "ssh", "snmptrap", "snmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.153.207.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:21:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:53:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5179, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.75.205.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:22:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:38:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.159.226.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:22:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:33:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.123.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:23:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:38:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.99.22.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:31:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:46:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.201.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:33:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T22:49:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.108.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T22:39:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:37:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19445, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.175.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:48:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:01:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "158.160.58.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:01:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.107.69.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:49:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:01:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.129.158.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:49:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:06:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.68.143.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:49:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:01:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.245.196.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:50:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:00:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.232.12.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:50:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:04:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.122.245.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:51:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:01:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.185.125.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:51:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:01:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.70.84.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:51:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:15:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.226.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T22:53:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:40:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.101.167", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-07T22:59:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:25:43Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 18, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "117.132.192.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T23:05:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:26:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 77, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.195.197.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T23:07:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:21:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "77.91.85.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-07T23:14:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:16:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.180.58.11", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-07T23:27:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:55:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "186.18.98.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-07T23:41:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T02:06:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.192.8", "classifications": [], "first_seen": { "$date": "2023-04-07T23:59:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-07T23:59:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.248.133.124", "classifications": [], "first_seen": { "$date": "2023-04-08T00:04:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:04:54Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 3, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.164.217.74", "classifications": [], "first_seen": { "$date": "2023-04-08T00:33:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T00:45:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 66, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.77.173.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T01:10:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T01:10:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.57.92", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-04-08T01:27:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:03:09Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46537, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.61.184.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T01:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:23:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.145.202.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T01:57:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T01:57:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.43.158.149", "classifications": [], "first_seen": { "$date": "2023-04-08T02:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T02:41:14Z" }, "ports": [ 12943, 19971 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 6, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "176.221.242.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T02:22:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T02:22:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.99.141.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T02:32:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:14:50Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7, "tags": [ "icmp", "ssh", "tcp", "Go" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.172.97.227", "classifications": [], "first_seen": { "$date": "2023-04-08T02:37:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T02:37:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "14.52.57.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T03:01:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.75.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T03:03:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:19:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 57, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.120.188.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T03:05:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:05:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.101.51.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T03:40:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T03:40:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.163.166.217", "classifications": [], "first_seen": { "$date": "2023-04-08T03:46:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:36:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 168, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.201.137.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T03:57:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:13:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.1.188.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T04:02:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:22:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.18.73.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T04:41:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:07:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.194.9.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T04:57:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T04:57:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "18.116.82.42", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-08T05:05:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:05:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP PING" ], "sightings": 45, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "185.208.172.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T05:07:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:43:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.64.166.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T05:09:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:09:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.215.191.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T05:09:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:26:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "2.228.25.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T05:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:25:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.220.7.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T05:29:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:29:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.151.11", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-08T05:31:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:31:22Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.142.125.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T05:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T05:45:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.133.204.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T05:46:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:36:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.188.30.114", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-08T05:55:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:13:11Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "182.73.123.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T06:07:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:52:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.196.94.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T06:17:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:23:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11077, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.237.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T06:26:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:57:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.227.130.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T06:38:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:51:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.207.113.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T06:40:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:53:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.18.211.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T06:41:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:56:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "137.184.37.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T06:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:54:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.197.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T06:44:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:55:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.80.215.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T06:55:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:55:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.232.27", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-04-08T06:58:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T06:58:21Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "89.248.163.240", "classifications": [], "first_seen": { "$date": "2023-04-08T07:05:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:58:17Z" }, "ports": [ 8433, 32165, 13462, 37590 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 1531, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.248.163.43", "classifications": [], "first_seen": { "$date": "2023-04-08T07:07:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:07:26Z" }, "ports": [ 61433 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 3, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.221.239.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T07:40:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:58:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.87.154.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T07:40:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:58:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.85.127", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T07:42:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:56:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "85.204.116.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T07:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T07:50:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.126.192.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T08:19:09Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:33:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.18.130.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T08:22:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:58:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.158.78.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T08:24:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:34:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.108.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T08:36:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:36:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.138.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T08:50:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:50:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.116.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T08:57:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:43:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.46.171.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T08:57:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T08:57:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.117.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T08:59:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:19:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.61.219.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T08:59:36Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:16:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "199.115.230.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T09:01:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:11:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.136.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T09:06:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:06:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.178.211.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T09:06:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:06:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.105.139.109", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-08T09:10:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:02:30Z" }, "ports": [ 177, 0 ], "reporting_nodes": 2, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.194.30", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-08T09:23:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:23:26Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.118.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T09:28:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:00:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.137.203.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T09:39:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:27:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET 3CORESec Poor Reputation IP group 7" ], "sightings": 28, "tags": [ "tcp", "brute_force", "ssh", "alert", "OpenSSH_8.2p1" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.147.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T09:53:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T09:53:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.150.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T10:15:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:31:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.143.72.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T10:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:31:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.211.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T10:15:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:52:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.190.40.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T10:20:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:34:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.98.62.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T10:29:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:42:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.193.55.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T10:51:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T10:51:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.253.15", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-08T10:51:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:54:16Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 24, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.156.237.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T11:19:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T11:19:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.240.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T12:06:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:16:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.200.155.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T12:18:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:35:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.98.58.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T12:22:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:22:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.150.66.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T12:22:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:32:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.188.29.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T12:41:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:46:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.214.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T12:44:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:44:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.49.165.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T12:47:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:47:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "164.92.196.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T12:57:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:07:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.87.146.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T12:58:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T12:58:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.174.37.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T13:00:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:00:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.27.131.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T13:00:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:00:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.44.1", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-08T13:07:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:11:00Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 10, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.87.66.121", "classifications": [], "first_seen": { "$date": "2023-04-08T13:16:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:10:12Z" }, "ports": [ 47917, 64769, 58148, 36592, 17544, 44791, 18495, 13422, 52142, 42386, 47930, 46022 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "(port_scan) TCP portscan" ], "sightings": 44, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "193.35.18.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T13:21:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:41:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-ICMP PING BSDtype", "PROTOCOL-ICMP PING Unix", "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "195.128.225.64", "classifications": [], "first_seen": { "$date": "2023-04-08T13:30:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:30:22Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 6, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.46.131.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T13:37:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:37:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.100.159.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T13:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:11:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 234, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.45.103.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T13:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:55:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.255.165.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T13:43:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T13:54:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.233.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T13:54:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:09:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.193.147.33", "classifications": [], "first_seen": { "$date": "2023-04-08T14:01:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:01:17Z" }, "ports": [ 26177 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.187.178.26", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-04-08T14:10:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:10:58Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "51.195.36.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T14:19:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:19:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.157.115.183", "classifications": [], "first_seen": { "$date": "2023-04-08T14:25:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:25:33Z" }, "ports": [ 1568 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.248.133.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T14:25:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:06:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24464, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.89.156.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T14:43:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:38:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.211.197.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T14:45:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:45:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "102.218.10.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T14:45:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:56:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.90.215.108", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-04-08T14:46:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:51:09Z" }, "ports": [ 0, 111 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 14, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.159.44.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T14:49:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:59:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.217.173.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T14:51:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:07:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.83.65.205", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-04-08T14:53:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:53:07Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "42.117.228.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T14:53:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:09:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "199.15.163.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T14:54:39Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T14:54:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.32.172.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T15:01:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:01:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.8.141.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T15:12:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:49:56Z" }, "ports": [ 50082, 49152, 0 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "tcp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.148.116.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T15:17:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:17:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T15:17:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:17:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.98.245.64", "classifications": [], "first_seen": { "$date": "2023-04-08T15:22:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:22:22Z" }, "ports": [ 1568 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.9.74.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T15:24:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:05:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "199.15.163.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T15:26:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:26:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "31.220.80.225", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T15:26:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T15:43:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "151.74.55.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T15:43:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:25:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.16.115.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T16:00:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:00:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.33.13.112", "classifications": [], "first_seen": { "$date": "2023-04-08T16:03:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:04:50Z" }, "ports": [ 24115, 28725, 5367 ], "reporting_nodes": 2, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 6, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "81.157.56.78", "classifications": [], "first_seen": { "$date": "2023-04-08T16:22:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:22:04Z" }, "ports": [ 1568 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "31.126.49.83", "classifications": [], "first_seen": { "$date": "2023-04-08T16:33:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:33:59Z" }, "ports": [ 1568 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.148.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T16:33:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:33:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.200.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T16:34:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:34:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.21", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-08T16:35:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:35:28Z" }, "ports": [ 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp" ], "sightings": 2, "tags": [ "tcp", "snmptrap" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.152.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T16:41:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:41:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.193.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T16:42:29Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:42:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.241.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T16:45:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:56:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.236.125.80", "classifications": [], "first_seen": { "$date": "2023-04-08T16:46:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T16:46:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.168.122.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T16:52:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:02:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.154.253.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T16:53:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:06:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.169", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-08T17:08:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:08:25Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.68.183.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T17:16:03Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:16:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.149.26.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T17:20:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:33:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.224.102.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T17:20:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:34:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.192.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T17:21:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:21:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.215.191.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T17:32:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:32:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.187.178.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T17:34:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T17:34:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.207.146.122", "classifications": [], "first_seen": { "$date": "2023-04-08T17:35:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:37:46Z" }, "ports": [ 1568 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.209.64.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T17:43:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:03:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T18:06:18Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:06:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.220.228.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T18:12:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:12:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.94.120.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T18:19:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:34:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.240.211.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T18:19:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:34:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.225.210.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T18:28:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:04:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8611, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.126.62.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T18:29:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:29:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.209.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T18:32:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:32:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "118.180.58.10", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-08T18:34:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:12:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 65, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "175.204.156.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T18:51:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T18:51:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "15.235.181.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T19:00:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:00:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.196.67", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-08T19:05:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:08:30Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.83.67.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T19:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:14:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.213.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T19:25:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:25:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.147.145.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T19:37:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:53:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.92.159.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T19:37:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:13:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.40.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T19:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:52:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "133.149.94.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T19:50:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:50:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.173.154.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T19:50:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:31:07Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) partial start line" ], "sightings": 48, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 5, "classification_count": 1 }, { "ioc": "115.148.152.90", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-08T19:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T19:53:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.156.155.13", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-08T19:54:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:53:30Z" }, "ports": [ 9018, 161 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp" ], "sightings": 4, "tags": [ "tcp", "snmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.202.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T19:56:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:10:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.146.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:05:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:05:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.236.237.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T20:14:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:27:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.11.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T20:16:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:51:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.178.242.90", "classifications": [], "first_seen": { "$date": "2023-04-08T20:17:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:17:37Z" }, "ports": [ 12436 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.144.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:38:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:38:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.185.236.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:43:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:43:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.113.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:44:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:44:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.142.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:47:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:47:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.245.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:55:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:55:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.116.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:56:00Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:39:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.207.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:58:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:58:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2002:6506:1ee2::1", "classifications": [], "first_seen": { "$date": "2023-04-08T20:58:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:58:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected" ], "sightings": 2, "tags": [ "ipv6-icmp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "101.6.30.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T20:58:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T20:58:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.16.83.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T21:02:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:02:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "8.42.17.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T21:04:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:20:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.253.55.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T21:16:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:28:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "96.246.158.165", "classifications": [], "first_seen": { "$date": "2023-04-08T21:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:20:20Z" }, "ports": [ 1568 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "47.253.33.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T21:21:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:21:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.224.131.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T21:23:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:41:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.58.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T21:23:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:35:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.145.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T21:23:37Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:38:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.124.77.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T21:34:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:34:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.162.15.1", "classifications": [], "first_seen": { "$date": "2023-04-08T21:37:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:24:45Z" }, "ports": [ 1568 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.124.204.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T21:37:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:37:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.42.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T21:39:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:30:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.186.147.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T21:45:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T21:45:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.236.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:00:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:00:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.253.81.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:01:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:01:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.128.73.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:09:31Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:09:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.37.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:12:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:12:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.207.175.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:14:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:14:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.253.54.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:17:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:31:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.253.56.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:19:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:18:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.34.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:21:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:30:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.40.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:26:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:31:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.8.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:26:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:27:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.46.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:40:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:40:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.39.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:42:08Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:42:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.37.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:45:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:35:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.62.65.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T22:45:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:56:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.252.35.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:47:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:52:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.38.156.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T22:47:34Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:01:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.7.186.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T22:48:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:55:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.143.24", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-08T22:51:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T22:51:46Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "177.220.131.211", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T23:19:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:40:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.153.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-08T23:24:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:19:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "44.204.115.14", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-08T23:25:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:25:59Z" }, "ports": [ 8888, 161, 162 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 6, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "170.187.164.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T23:33:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:33:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.252.39.190", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T23:36:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-08T23:36:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.153.169.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-08T23:37:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:15:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 202, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.217.5.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T00:16:22Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:22:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.37.74.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T00:21:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:21:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.69.136.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T00:38:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:38:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.182.19.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T00:47:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T00:48:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.115.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T00:59:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:15:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.210.96.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T01:02:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:49:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49646, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T01:05:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:05:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.70.221.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T01:11:47Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:30:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.141.139.216", "classifications": [], "first_seen": { "$date": "2023-04-09T01:12:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:12:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "143.198.92.3", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T01:15:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:29:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.187.230.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T01:48:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T01:48:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.232.250.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T01:54:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:21:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 42, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.95.132.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:00:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:31:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5154, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.195.236.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:01:52Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:21:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.163.235.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:04:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:17:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.23.144.54", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-09T02:19:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:19:20Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "23.224.186.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T02:33:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:33:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.182.69.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:36:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:52:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.57.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:36:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:56:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "206.189.130.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:36:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:58:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "61.2.241.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:36:50Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:28:35Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 170", "ET SCAN Potential SSH Scan" ], "sightings": 363, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "223.178.86.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:41:04Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:23:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 62, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.183.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:41:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T02:56:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.254.196.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T02:49:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:24:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.166.173.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:51:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:52:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.223.17.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T02:58:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:14:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.42.49.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T03:06:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:06:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.130.82.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T03:12:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:37:25Z" }, "ports": [ 809, 3389, 0 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "tcp", "rdp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "111.47.69.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T03:30:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:30:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "13.40.126.226", "classifications": [], "first_seen": { "$date": "2023-04-09T03:34:35Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:35:41Z" }, "ports": [ 4369, 2869 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.39.49.175", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-09T03:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T03:38:30Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "188.166.5.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T03:58:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:15:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.255.141.245", "classifications": [], "first_seen": { "$date": "2023-04-09T04:01:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:51:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window", "(port_scan) TCP portscan" ], "sightings": 10, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "79.165.201.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:03:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:21:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "180.250.80.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:09:24Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:26:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.96.172.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:11:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:29:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.35.2.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:12:07Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:25:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.111.244.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:14:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:31:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.128.135.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:14:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:20:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is missing", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 82, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.152.194.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:16:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:49:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 12, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.95.146.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T04:36:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:03:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.150.99.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:37:51Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:38:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.58.37", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-04-09T04:45:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:58:45Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 26694, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.180.136.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T04:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:46:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.52.170.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:52:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:52:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.172.179.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T04:57:05Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T04:57:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.100.28.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T05:00:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:08:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.150.105.183", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-09T05:13:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:13:16Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 2, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.44.135.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T05:15:25Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:15:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T05:17:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:39:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.170.254.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T05:59:19Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T05:59:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.193.144.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T06:04:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:04:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.107.181.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T06:13:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:15:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.89.66.50", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T06:19:54Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:40:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.178.239.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T06:21:48Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:12:14Z" }, "ports": [ 9123, 10023, 0 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "tcp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "104.131.128.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T06:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:30:12Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.202.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T06:32:30Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:32:30Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "8.213.27.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T06:39:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:51:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.226.78.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T06:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:52:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.24.86.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T06:42:17Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:42:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.240.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T06:56:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T06:56:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.107.229", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T07:17:55Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:17:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "213.194.136.116", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T07:42:33Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:02:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.206.6.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T07:45:59Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:47:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.237.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T07:50:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T07:50:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.198.193.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T08:05:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:06:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.161.25.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T08:09:45Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:09:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.10.154.193", "classifications": [], "first_seen": { "$date": "2023-04-09T08:12:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:17:13Z" }, "ports": [ 6699, 84, 9924 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 6, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.18.47.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T08:17:13Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T08:17:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.94.224.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T09:03:53Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:03:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.108.102.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T09:12:20Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:22:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.200.116.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T09:18:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:13:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.95.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T09:38:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:38:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.202.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T09:41:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:46:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "66.70.208.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T09:41:52Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:08:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 173" ], "sightings": 47, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2002:6506:14e2::1", "classifications": [], "first_seen": { "$date": "2023-04-09T09:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:43:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected" ], "sightings": 2, "tags": [ "ipv6-icmp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "101.6.20.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T09:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:43:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.244.144.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T09:46:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T09:49:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "14.99.176.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T10:19:50Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:19:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.43.99.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T10:24:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:36:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "149.3.127.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T10:35:01Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:35:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.109.109.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T10:44:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:44:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.41.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T10:57:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:57:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.244.134.29", "classifications": [], "first_seen": { "$date": "2023-04-09T10:58:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:58:14Z" }, "ports": [ 9090 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP distributed portscan" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.22.217.76", "classifications": [], "first_seen": { "$date": "2023-04-09T10:58:14Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T10:58:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "88.247.171.216", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-04-09T11:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:10:21Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "93.131.32.65", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T11:19:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:33:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.44.244.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T11:19:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:19:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.234.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T11:39:02Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:49:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.46.213.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T11:44:56Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T11:44:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.62.122.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T12:27:57Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:37:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.131.58.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T12:28:40Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:42:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.201.44.247", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-04-09T12:31:06Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:31:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "143.110.164.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T12:57:32Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T12:57:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.119.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T13:05:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:43:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.114.171.19", "classifications": [], "first_seen": { "$date": "2023-04-09T13:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:08:15Z" }, "ports": [ 8088 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "49.231.7.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T13:28:10Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:36:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.218.158.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T13:35:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:35:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.240.252.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T13:36:42Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:18:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "151.0.165.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T13:37:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T03:32:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 51" ], "sightings": 76, "tags": [ "tcp", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "133.130.89.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T13:43:26Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:55:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "52.77.179.81", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-09T13:49:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:49:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.112.75.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T13:50:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:50:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "126.29.123.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T13:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T13:56:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.99.217.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T14:11:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:11:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.178.169.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T14:12:21Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:12:18Z" }, "ports": [ 44443, 8383, 8008, 0 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54, "tags": [ "tcp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "18.169.170.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T14:17:28Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:15:37Z" }, "ports": [ 2811, 10011, 0 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "tcp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "216.218.206.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T14:21:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:33:22Z" }, "ports": [ 80, 0 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "39.171.38.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T14:32:44Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:32:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.207.122.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T14:41:16Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:41:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.139.28.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T14:48:38Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T14:48:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.104.31.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-04-09T15:08:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:20:18Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 432, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.58.240", "classifications": [], "first_seen": { "$date": "2023-04-09T15:08:58Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:08:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.156.238.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T15:19:11Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:19:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.170.34.80", "classifications": [], "first_seen": { "$date": "2023-04-09T15:21:41Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:22:51Z" }, "ports": [ 7117, 22 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "109.205.213.18", "classifications": [], "first_seen": { "$date": "2023-04-09T15:21:49Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:21:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic" ], "sightings": 6, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.241.226.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-04-09T15:32:27Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:32:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.128.244.159", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-04-09T15:44:23Z" }, "ja3": [], "last_seen": { "$date": "2023-04-09T15:44:23Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "140.179.224.203", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T18:56:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:10:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 731873, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "187.191.99.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T18:57:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T18:59:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22377, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.129.253.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T18:58:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T18:58:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11189, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.176.96.75", "classifications": [], "first_seen": { "$date": "2023-06-27T18:56:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T19:41:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1389, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.92.0.33", "classifications": [], "first_seen": { "$date": "2023-06-27T18:59:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T14:56:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 420, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.69.184.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:00:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:45:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 89441, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.228.39", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:00:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:25:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 882743, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.225.147", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:01:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:21:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 818427, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "209.159.146.19", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:02:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:02:14Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33513, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "44.213.45.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:02:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:22:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 6625849, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.83.40.111", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:04:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:25:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2895326, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.193.117", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:04:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:25:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2910049, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.53.239", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:04:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:20:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3288758, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.62.0", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:04:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:29:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3428964, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.121.204", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:04:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:26:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3237503, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.161.210", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:04:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:06:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2769927, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.118.169", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:04:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:12:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3093862, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.228.95", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:04:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:02:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3074069, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.34.48", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:54:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2504364, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.18.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:27:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2467013, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.159.0", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:12:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3247261, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.123.38", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:27:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2389091, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.45.95", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:03:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3126678, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.225.169", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:19:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3143564, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.78.200", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:19:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2506728, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "13.214.173.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:26:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4600025, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.224.160", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:05:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:25:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1227243, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.50.126", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:06:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:14:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2735784, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.127.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:06:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:28:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2666804, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.104.12", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:06:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:26:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3150753, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.30.24", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:06:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:04:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3080397, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.90.53", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:07:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:29:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3016155, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.219.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:07:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:14:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3640342, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.208.12", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:07:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:49:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3005028, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.48.52", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:08:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:24:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3465147, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.18.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:08:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3123723, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.74.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:08:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:59:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3036785, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.245.156", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:08:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:21:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2558708, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.183.9", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:09:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:11:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2633459, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.250.25", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:09:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:52:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3084173, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.29.46", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:09:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:03:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3038273, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.54.145.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:09:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:09:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37994, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.189.52.106", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:10:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:24:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3665006, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "68.79.52.139", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:10:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:24:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2841721, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.128.16", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:10:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:59:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2607837, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.67.151", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:10:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:02:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2632763, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.79.163", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:12:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:28:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3171294, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.53.148", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:12:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:17:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3029728, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.78.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:12:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:12:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 94598, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.83.13.48", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:12:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:28:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2294141, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.157.253", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:13:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:55:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2455590, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.54.241", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:13:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:17:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2842835, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.93.194", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:13:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:21:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2205034, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.11.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:13:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:27:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3154400, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.131.208.102", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:14:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:56:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3378939, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.254.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:14:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:46:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2331882, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.31.215", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:14:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:25:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3014252, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.69.224", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:14:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:49:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2767106, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "218.92.0.53", "classifications": [], "first_seen": { "$date": "2023-06-27T19:14:02Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T16:09:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 806, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.79.17.166", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:15:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:29:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2844110, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.190.102", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:15:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2694870, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.110.74", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:17:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:55:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3079391, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.128.148", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:17:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:51:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2429845, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.131.222.234", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:17:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:16:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3248789, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.142.54.12", "classifications": [], "first_seen": { "$date": "2023-06-27T19:18:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:01:35Z" }, "ports": [ 33778, 59808, 33841, 45238, 59576, 58082, 43051, 37499, 49749, 33975, 45527, 48980, 40035 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 59260, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.223.42.55", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:19:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:55:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2867051, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.236.71", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:19:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:16:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2503259, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.68.165", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:19:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:56:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3158059, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.79.18", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:21:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:50:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2321117, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.185.232", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:21:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:00:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2617456, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.107.237", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:21:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3468988, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.244.1", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:21:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:19:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2471720, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "82.13.182.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:21:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:21:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36750, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.82.251.139", "classifications": [], "first_seen": { "$date": "2023-06-27T19:21:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:29:44Z" }, "ports": [ 51564, 42652 ], "reporting_nodes": 2, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 3540012, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "52.82.65.11", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:22:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:42:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2643812, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.58.16", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:22:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2739295, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.101.77", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:22:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:01:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2028773, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.243.249", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:24:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:17:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3043484, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.9.228", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:25:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:28:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3153665, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.155.91.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:26:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:02:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 129259, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.189.87.48", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:27:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:13:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3243329, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.62.197.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:27:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:27:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35440, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.235.141.109", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:28:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2749914, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.192.90.223", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:28:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2744887, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.230.238.203", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:29:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:21:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2775932, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.134.144.194", "classifications": [], "first_seen": { "$date": "2023-06-27T19:27:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T06:47:34Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 672, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.92.0.47", "classifications": [], "first_seen": { "$date": "2023-06-27T19:29:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T14:27:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 483, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.235.187.138", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:30:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:46:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1024438, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.57.62", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:33:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:54:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2450315, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.181.212", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:33:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:03:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2718896, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.189.161.63", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:34:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:29:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2322307, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.107.144", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:34:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:02:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2551840, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "69.235.138.138", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:35:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:19:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3445246, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.19.220", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:38:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:27:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3419759, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "42.240.129.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:38:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:38:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34844, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.223.23.116", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:42:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:57:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2398124, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "116.42.149.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:42:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:52:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 142703, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.192.14.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:43:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2769698, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.77.156", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:43:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:57:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2002235, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "57.128.11.39", "classifications": [], "first_seen": { "$date": "2023-06-27T19:32:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T19:34:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 4004, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.15.221.10", "classifications": [], "first_seen": { "$date": "2023-06-27T19:33:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T19:36:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 4004, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "68.79.22.245", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:46:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2021078, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.82.64.41", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:49:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:28:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2943107, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.88.240.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:51:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:34:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60898, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.223.250.14", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:51:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:06:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2813425, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "34.229.96.176", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:53:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:10:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 209881, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.69.113", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:56:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:58:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2711978, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.98.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:56:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:56:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30912, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T19:56:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T19:56:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30878, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.80.74.79", "classifications": [], "first_seen": { "$date": "2023-06-27T20:02:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:02:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 450, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "87.236.176.109", "classifications": [], "first_seen": { "$date": "2023-06-27T20:08:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:08:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 14885, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.235.184.15", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:10:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:31:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 691536, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.166.153.205", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:12:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:21:50Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 227257, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "58.176.84.194", "classifications": [], "first_seen": { "$date": "2023-06-27T20:14:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:14:45Z" }, "ports": [ 43906, 1071 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 15966, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.232.160.106", "classifications": [], "first_seen": { "$date": "2023-06-27T20:05:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:47:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1938, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "197.255.225.96", "classifications": [], "first_seen": { "$date": "2023-06-27T20:06:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:06:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 89, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "207.249.96.38", "classifications": [], "first_seen": { "$date": "2023-06-27T20:07:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:07:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 124" ], "sightings": 89, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "154.83.12.80", "classifications": [], "first_seen": { "$date": "2023-06-27T20:08:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:54:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1841, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.206.155", "classifications": [], "first_seen": { "$date": "2023-06-27T20:08:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:49:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 56", "ET SCAN Potential SSH Scan" ], "sightings": 4998, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "102.128.78.76", "classifications": [], "first_seen": { "$date": "2023-06-27T20:11:34Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:14:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 623, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.134.93.102", "classifications": [], "first_seen": { "$date": "2023-06-27T20:12:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:53:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1843, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.48.76.243", "classifications": [], "first_seen": { "$date": "2023-06-27T20:12:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T21:10:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2605, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "218.92.0.21", "classifications": [], "first_seen": { "$date": "2023-06-27T20:13:34Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:06:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 566, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "164.152.38.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:21:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:21:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.131.28.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:21:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:21:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29412, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.117.252.121", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:21:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:21:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 75014, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.93.16.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:23:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:22:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 192957, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.79.5.54", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:25:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:57:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 189569, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "67.220.245.25", "classifications": [], "first_seen": { "$date": "2023-06-27T20:17:25Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-29T22:17:25Z" }, "ports": [ 36250, 58302, 49820 ], "reporting_nodes": 1, "rules": [], "sightings": 97, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "69.164.203.231", "classifications": [], "first_seen": { "$date": "2023-06-27T20:31:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:31:08Z" }, "ports": [ 47130, 53645, 37324, 50196, 44789, 35370 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 16544, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.223.32.232", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:34:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:34:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 96577, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "106.15.193.216", "classifications": [ "Misc activity", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-27T20:39:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:09:42Z" }, "ports": [ 0, 1900, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 476853, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "109.248.149.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:40:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:33:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 94318, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.200.80.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T20:40:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:55:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 100361, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.200.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:45:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:21:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 43695, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.92.0.51", "classifications": [], "first_seen": { "$date": "2023-06-27T20:43:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T12:58:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 710, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "122.228.142.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:47:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:59:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 51488, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.132.109.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:49:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:50:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56540, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.134.201", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:56:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:56:00Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 85929, "tags": [ "udp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "14.53.155.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T20:58:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T20:58:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28636, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.236.26.204", "classifications": [], "first_seen": { "$date": "2023-06-27T20:54:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T20:56:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 3784, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "104.248.46.211", "classifications": [], "first_seen": { "$date": "2023-06-27T20:55:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T21:33:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2203, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.155.137.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T20:56:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:27:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1642, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.5.104.132", "classifications": [], "first_seen": { "$date": "2023-06-27T20:57:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T21:22:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 2883, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "218.92.0.37", "classifications": [], "first_seen": { "$date": "2023-06-27T20:58:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:11:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "SSH Login Attempts" ], "sightings": 386, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.82.137.45", "classifications": [], "first_seen": { "$date": "2023-06-27T21:00:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T21:41:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1691, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.155.168.85", "classifications": [], "first_seen": { "$date": "2023-06-27T21:00:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T21:41:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1861, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.15.159.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:01:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:55:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 70481, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "44.215.106.237", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:01:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:10:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 189263, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "109.207.200.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:02:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:19:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 177548, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.27.128.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T21:02:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:43:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 420709, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "218.92.0.59", "classifications": [], "first_seen": { "$date": "2023-06-27T21:13:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:20:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 465, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "67.220.244.190", "classifications": [], "first_seen": { "$date": "2023-06-27T21:17:27Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-30T02:17:24Z" }, "ports": [ 46106, 45840, 52706, 43020 ], "reporting_nodes": 1, "rules": [], "sightings": 110, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "69.235.184.53", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:15:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:57:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 941608, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.107.221.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:21:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:21:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41752, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.80.233.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:32:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:32:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29073, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.104.255.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:35:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:35:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28092, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.188.248.77", "classifications": [], "first_seen": { "$date": "2023-06-27T21:37:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:37:31Z" }, "ports": [ 445 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 41831, "tags": [ "tcp", "smb" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.110.49.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:42:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:42:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27888, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.5.145.44", "classifications": [], "first_seen": { "$date": "2023-06-27T21:43:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:43:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 13942, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.132.238.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:52:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:58:45Z" }, "ports": [ 0, 48311, 15942, 17366, 13007, 8411 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(tcp) TCP PDU missing ack for established session", "(tcp) TCP urgent pointer exceeds payload length or no payload" ], "sightings": 83702, "tags": [ "icmp", "tcp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "204.12.239.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T21:56:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T21:56:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27878, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.237.227", "classifications": [], "first_seen": { "$date": "2023-06-27T21:54:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T21:54:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146" ], "sightings": 82, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "3.18.36.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T21:55:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:11:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20700, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.10.231.109", "classifications": [], "first_seen": { "$date": "2023-06-27T21:55:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T22:01:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 3936, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "38.54.105.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:00:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:00:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 55732, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.218.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:00:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:03:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 211023, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.205.57.38", "classifications": [], "first_seen": { "$date": "2023-06-27T22:09:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:19:41Z" }, "ports": [ 55462, 50594, 46930, 36767, 41765, 54873, 45079, 42974, 45291 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 25342, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "74.84.150.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:13:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:13:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27388, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.97", "classifications": [], "first_seen": { "$date": "2023-06-27T22:13:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:13:36Z" }, "ports": [ 14337 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 13680, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.219.251.168", "classifications": [], "first_seen": { "$date": "2023-06-27T22:09:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T22:11:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 1539, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "41.111.227.75", "classifications": [], "first_seen": { "$date": "2023-06-27T22:10:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T22:12:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 1458, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "218.92.0.45", "classifications": [], "first_seen": { "$date": "2023-06-27T22:12:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T15:54:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 513, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "132.226.230.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T22:16:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:36:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 121732, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.37.190", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:17:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:17:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27237, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.42.174.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:18:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:49:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 167463, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.154.243.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:23:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:44:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 73835, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.118.32.254", "classifications": [], "first_seen": { "$date": "2023-06-27T22:22:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T22:25:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 2400, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.134.181.196", "classifications": [], "first_seen": { "$date": "2023-06-27T22:23:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T23:04:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1583, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.89.149.252", "classifications": [], "first_seen": { "$date": "2023-06-27T22:29:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T23:09:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1729, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.235.184.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:36:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:20:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 687127, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.145.101.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:42:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T22:42:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26989, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.92.0.43", "classifications": [], "first_seen": { "$date": "2023-06-27T22:42:00Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T16:37:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 581, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "151.106.39.190", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:46:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:27:01Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 192006, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "66.36.234.6", "classifications": [ "Misc activity", "Generic Protocol Command Decode" ], "first_seen": { "$date": "2023-06-27T22:49:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:05:08Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-VOIP inbound INVITE message" ], "sightings": 186067, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "38.7.199.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T22:55:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:21:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 53679, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "97.133.105.187", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T23:00:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:01:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26205, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.188.26.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T23:00:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:40:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 380521, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "67.205.187.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T23:02:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:15:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174", "ET SCAN Potential SSH Scan" ], "sightings": 143735, "tags": [ "tcp", "ssh", "alert", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.216.150.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:13:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:13:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 51026, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.160.130", "classifications": [], "first_seen": { "$date": "2023-06-27T23:09:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T23:09:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 77, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "218.92.0.52", "classifications": [], "first_seen": { "$date": "2023-06-27T23:11:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:15:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "SSH Login Attempts" ], "sightings": 501, "tags": [ "alert", "tcp", "ssh", "brute_force" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "198.235.24.74", "classifications": [ "Executable code was detected", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-27T23:15:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:15:31Z" }, "ports": [ 22, 0, 53 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 12734, "tags": [ "tcp", "ssh", "icmp", "udp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "35.203.210.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:16:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:16:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50777, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:17:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:18:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50724, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "149.102.231.152", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-27T23:19:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:47:57Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 53383, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.203.210.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:19:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:19:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50632, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:28:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:28:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25223, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.146.121.54", "classifications": [], "first_seen": { "$date": "2023-06-27T23:25:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-27T23:25:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 152, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_7.9p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "135.125.42.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:41:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:41:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25067, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.92.0.28", "classifications": [], "first_seen": { "$date": "2023-06-27T23:41:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T12:44:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 339, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "108.181.63.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:55:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:17:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 292776, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:56:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:56:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 59367, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:56:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:56:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49549, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.62.22.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:56:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:39:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49330, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.67.60.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:56:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:56:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35703, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.37.80.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T23:58:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:14:52Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 136000, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "24.199.116.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-27T23:58:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:58:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12384, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-27T23:59:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-27T23:59:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49515, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.70.176.28", "classifications": [], "first_seen": { "$date": "2023-06-28T00:00:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:03:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 3256, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.216.150.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:06:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:07:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49402, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.12.47.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:07:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:16:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49070, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.89.156", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:07:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:55:17Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 85038, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "209.141.51.76", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:10:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:26:45Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 166416, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.112.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:12:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:12:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.111.178.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:14:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:14:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24658, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.207.210.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:14:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:14:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24805, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.203", "classifications": [], "first_seen": { "$date": "2023-06-28T00:05:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:05:23Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 73, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.92.0.40", "classifications": [], "first_seen": { "$date": "2023-06-28T00:10:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T16:52:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 411, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.38.191.187", "classifications": [], "first_seen": { "$date": "2023-06-28T00:14:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:54:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1219, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "130.61.35.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T00:15:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:32:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 172272, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "122.14.250.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T00:15:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:42:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 258015, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.236.24.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T00:20:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:39:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 221294, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "110.164.203.131", "classifications": [], "first_seen": { "$date": "2023-06-28T00:30:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:33:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 3168, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "188.128.82.178", "classifications": [], "first_seen": { "$date": "2023-06-28T00:32:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T01:21:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 98" ], "sightings": 2953, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "199.59.243.223", "classifications": [], "first_seen": { "$date": "2023-06-28T00:33:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:33:20Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 12288, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.233.234.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:39:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:39:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24555, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.36.237.39", "classifications": [], "first_seen": { "$date": "2023-06-28T00:38:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T00:38:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 168" ], "sightings": 71, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "217.182.140.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T00:49:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:16:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7172, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "150.129.136.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:48:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:38:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 182724, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.214.27.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:49:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:24:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48770, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.222.122.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:51:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:51:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26471, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.112.73.18", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:55:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:55:25Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 53533, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "70.52.49.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T00:57:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T00:57:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24503, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.177.184.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:03:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:03:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:03:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:03:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32676, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:04:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:05:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48942, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.124.77.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:05:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:05:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24472, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:06:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:07:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48918, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.98.55.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:10:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:08:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 75290, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:10:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:10:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:12:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:12:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48799, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:15:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:16:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48706, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.221.211", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:27:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:33:52Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 65529, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "109.207.200.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:28:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:30:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 115995, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.5.145.110", "classifications": [], "first_seen": { "$date": "2023-06-28T01:29:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T01:31:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 1292, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "142.93.201.51", "classifications": [], "first_seen": { "$date": "2023-06-28T01:29:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T01:29:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 43" ], "sightings": 68, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.133.204.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T01:29:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:34:50Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8924, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.137.195.150", "classifications": [], "first_seen": { "$date": "2023-06-28T01:30:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T02:09:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1334, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.143.32.80", "classifications": [], "first_seen": { "$date": "2023-06-28T01:35:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T01:35:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 68, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "172.105.221.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:34:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:34:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24231, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.186.55.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:36:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:36:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24818, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.50.147", "classifications": [], "first_seen": { "$date": "2023-06-28T01:42:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:27:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 929, "tags": [ "ssh", "tcp", "ssh", "ssh", "libssh-0.2" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "47.97.35.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:45:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:45:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24215, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.106.38.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:45:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:09:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 98851, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.61.208.180", "classifications": [], "first_seen": { "$date": "2023-06-28T01:46:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T01:46:07Z" }, "ports": [ 36320, 10809, 51029, 14592 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 12278, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "201.217.195.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T01:48:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:01:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 132847, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.250.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T01:49:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:05:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 144760, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.210.246.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:49:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:17:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 237911, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.172.12.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T01:50:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:03:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 132742, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.172.225.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T01:52:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:36:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 359703, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.99.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T01:52:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:15:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 248440, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "149.202.67.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T01:58:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:26:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49929, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.125.211", "classifications": [], "first_seen": { "$date": "2023-06-28T01:58:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T02:42:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1292, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.155.155.191", "classifications": [], "first_seen": { "$date": "2023-06-28T01:59:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T02:40:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1932, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "79.137.35.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:00:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:00:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24122, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:01:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:01:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48208, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.70.159.102", "classifications": [], "first_seen": { "$date": "2023-06-28T02:04:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:46:31Z" }, "ports": [ 43764, 59889, 38013, 36636, 48391, 33937, 57375, 53609, 37298, 45199, 50547, 37911, 55028, 48127, 52892, 54397, 52927, 46656, 41775, 54357, 38726, 53457, 44154 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 26285, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.210.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:06:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:50:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 87085, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:07:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:08:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 49262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.107.151.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T02:08:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:08:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24051, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.226.209.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T02:19:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:39:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 131061, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "128.199.49.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T02:19:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:58:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 354384, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.135.155.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T02:20:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:34:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 131183, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.251", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-28T02:21:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:21:40Z" }, "ports": [ 1434, 0, 53 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 35991, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.150.190", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:22:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:22:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48984, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.78.79.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T02:26:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:27:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23893, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "86.107.179.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:27:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:27:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23888, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.154.108.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T02:28:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:28:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24754, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.209", "classifications": [], "first_seen": { "$date": "2023-06-28T02:31:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T02:31:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 64, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.235.24.98", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:32:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:32:45Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46586, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.12.74.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:34:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:34:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23751, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:44:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:44:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 47216, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.66.108.186", "classifications": [], "first_seen": { "$date": "2023-06-28T02:43:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T02:43:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 63, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.170.225.4", "classifications": [], "first_seen": { "$date": "2023-06-28T02:48:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T02:48:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 252, "tags": [ "alert", "tcp", "ssh", "anomaly" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "205.210.31.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:54:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:54:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23344, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.189.202.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T02:56:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:56:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23259, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T02:58:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T02:58:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23780, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.234.238", "classifications": [], "first_seen": { "$date": "2023-06-28T03:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T03:45:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1331, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "121.127.45.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 226416, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.25.174.4", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 208586, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "102.214.66.37", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 208835, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.143.124.37", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 216286, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.244.64.228", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 215730, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "223.224.21.41", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 215233, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "201.56.69.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 208046, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "200.252.184.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 205408, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "27.123.176.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 201782, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "37.19.219.16", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 199179, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.39.114.138", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 195864, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "58.82.191.196", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 195050, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "82.199.217.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 193878, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "181.233.89.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 197996, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "115.67.106.40", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 189210, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "160.119.165.5", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 188878, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "102.67.196.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:01:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:01:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 188560, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.150.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:09:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:10:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39424, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.223.98.213", "classifications": [], "first_seen": { "$date": "2023-06-28T03:14:50Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T03:18:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 2684, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "167.94.138.52", "classifications": [], "first_seen": { "$date": "2023-06-28T03:22:40Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T03:22:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 122, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.210.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:15:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:15:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39252, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.15.226.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:15:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:37:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39050, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.19.191.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:20:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:30:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 112921, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.189.133.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:23:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:23:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19462, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:29:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:30:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "207.154.225.47", "classifications": [], "first_seen": { "$date": "2023-06-28T03:24:11Z" }, "ja3": [ "19e29534fd49dd27d09234e639c4057e" ], "last_seen": { "$date": "2023-06-28T03:24:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Mismatch protocol both directions", "APPLAYER_MISMATCH_PROTOCOL_BOTH_DIRECTIONS", "REQUEST_BODY_UNEXPECTED", "SURICATA HTTP Unexpected Request body" ], "sightings": 360, "tags": [ "alert", "tcp", "ssh", "anomaly", "tls", "http" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "191.9.123.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T03:26:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:58:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1902, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.215.223.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T03:32:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:12:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 485, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.81.5", "classifications": [], "first_seen": { "$date": "2023-06-28T03:37:51Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T03:37:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "35.203.210.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:31:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:31:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48951, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:36:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:37:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38875, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.204.129.184", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:37:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:46:31Z" }, "ports": [ 65476, 0, 52000, 51000, 5080, 5070 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 177255, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.150.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:42:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:43:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39872, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.83.189.163", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:45:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:45:27Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29138, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "172.104.89.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:49:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:49:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32897, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.19.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:52:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:52:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19408, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T03:57:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T03:57:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38791, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:01:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:01:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38768, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.192.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:12:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:12:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19134, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.42.94.21", "classifications": [], "first_seen": { "$date": "2023-06-28T04:24:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T04:28:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 1925, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "35.203.210.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:30:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:31:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 45815, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.226.145.164", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:34:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:34:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 56554, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.88.240.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:39:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:51:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54371, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:41:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:42:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 47518, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.252.75.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:43:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:11:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36479, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.200.181.42", "classifications": [], "first_seen": { "$date": "2023-06-28T04:46:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T04:57:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 162, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "160.153.234.75", "classifications": [], "first_seen": { "$date": "2023-06-28T04:51:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T05:25:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 63", "ET SCAN Potential SSH Scan" ], "sightings": 2991, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "218.92.0.26", "classifications": [], "first_seen": { "$date": "2023-06-28T04:53:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T14:12:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 316, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.210.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:46:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:48:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38791, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:53:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:54:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37471, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.10.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T04:57:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T04:57:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18705, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.39.119.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:12:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:12:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18654, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:13:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:13:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37406, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:19:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:20:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46715, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:21:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:21:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.204.171", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:22:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:22:56Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18495, "tags": [ "tcp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.203.210.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:22:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:23:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37268, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.238.186.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:28:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:28:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18642, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.55.75.8", "classifications": [], "first_seen": { "$date": "2023-06-28T05:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T06:43:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 8", "ET SCAN Potential SSH Scan" ], "sightings": 2604, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "129.154.58.21", "classifications": [], "first_seen": { "$date": "2023-06-28T05:51:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T06:04:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 255, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "144.22.148.94", "classifications": [], "first_seen": { "$date": "2023-06-28T05:53:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T06:50:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 496, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "154.23.141.12", "classifications": [], "first_seen": { "$date": "2023-06-28T05:55:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T06:40:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 1003, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "182.23.67.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T05:35:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:13:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 269292, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:37:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:38:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37240, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:40:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:40:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18632, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:44:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:44:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37227, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.140.202.18", "classifications": [], "first_seen": { "$date": "2023-06-28T06:07:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T07:42:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 3658, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "41.72.105.171", "classifications": [], "first_seen": { "$date": "2023-06-28T06:14:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T06:25:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 100, "tags": [ "ssh", "tcp", "ssh", "ssh", "libssh-0.1" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "202.184.229.57", "classifications": [], "first_seen": { "$date": "2023-06-28T06:27:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T07:15:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 970, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "141.24.133.142", "classifications": [], "first_seen": { "$date": "2023-06-28T05:48:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:53:20Z" }, "ports": [ 60546, 31568, 49347, 56095 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 18253, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.149.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:52:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:52:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37205, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:53:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:53:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37204, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:55:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:56:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37192, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:55:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:56:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 37188, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.154.217.25", "classifications": [], "first_seen": { "$date": "2023-06-28T05:56:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:56:21Z" }, "ports": [ 15934, 38885, 34155, 46144, 61025, 48732, 15715, 1945, 31395 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP has no SYN, ACK, or RST", "(port_scan) TCP portscan" ], "sightings": 23245, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "13.234.137.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T05:59:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T05:59:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.178.78", "classifications": [], "first_seen": { "$date": "2023-06-28T06:29:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T07:13:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 146", "ET SCAN Potential SSH Scan" ], "sightings": 2423, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "64.227.126.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T06:07:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:21:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120099, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.113", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-06-28T06:09:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:09:43Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 18540, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "143.42.120.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:10:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:23:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33180, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.226.198.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T06:10:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:47:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 274304, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:12:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:13:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48520, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.92.0.55", "classifications": [], "first_seen": { "$date": "2023-06-28T06:50:08Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T22:18:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 221, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "89.248.165.214", "classifications": [], "first_seen": { "$date": "2023-06-28T07:00:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T07:00:38Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 48, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.133.2.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T06:16:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:32:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 110229, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.248.165.14", "classifications": [], "first_seen": { "$date": "2023-06-28T07:10:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T07:10:49Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ET CINS Active Threat Intelligence Poor Reputation IP group 85" ], "sightings": 94, "tags": [ "alert", "tcp", "http" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "67.220.243.238", "classifications": [], "first_seen": { "$date": "2023-06-28T07:17:29Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-29T02:17:31Z" }, "ports": [ 44560, 50568, 41050, 51218 ], "reporting_nodes": 1, "rules": [], "sightings": 127, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.155.91.76", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:35:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:09:13Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 129952, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.150.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:35:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:35:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36380, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:42:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:42:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36086, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.74.29.22", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:42:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:09:19Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 53559, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.149.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:42:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:42:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.162.52.98", "classifications": [], "first_seen": { "$date": "2023-06-28T07:57:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T07:57:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 138, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.78.21.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T06:48:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:29:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 264609, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:49:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:49:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17922, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.53.253.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T06:51:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:03:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 80123, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T06:53:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T06:54:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35767, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.83.93.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T06:54:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:02:56Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53468, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "60.241.52.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:00:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:00:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17778, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.91.159", "classifications": [], "first_seen": { "$date": "2023-06-28T08:01:00Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T08:38:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 985, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "70.169.84.74", "classifications": [], "first_seen": { "$date": "2023-06-28T08:02:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T08:40:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1336, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.223.198.159", "classifications": [], "first_seen": { "$date": "2023-06-28T08:02:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T08:38:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 940, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "202.166.174.235", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:03:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:03:28Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26604, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "81.232.78.50", "classifications": [], "first_seen": { "$date": "2023-06-28T07:09:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:09:13Z" }, "ports": [ 6456, 57545 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 9531, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.149.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:14:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:15:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35209, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:20:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:20:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 35094, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.219.255.247", "classifications": [], "first_seen": { "$date": "2023-06-28T09:06:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:24:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 642, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.78.21.29", "classifications": [], "first_seen": { "$date": "2023-06-28T09:06:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:47:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1269, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "8.222.144.176", "classifications": [], "first_seen": { "$date": "2023-06-28T09:07:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:21:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 514, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.168.132.152", "classifications": [], "first_seen": { "$date": "2023-06-28T09:08:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:45:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 980, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.118.51", "classifications": [], "first_seen": { "$date": "2023-06-28T09:09:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:47:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 975, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.120.20.189", "classifications": [], "first_seen": { "$date": "2023-06-28T09:13:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:58:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 758, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "58.144.251.22", "classifications": [], "first_seen": { "$date": "2023-06-28T09:16:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T09:16:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 147, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.21.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T07:38:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:12:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 251596, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.252.15.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T07:43:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:21:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 183771, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.98.133.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:46:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:46:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17971, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:54:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:54:08Z" }, "ports": [ 5632, 0 ], "reporting_nodes": 2, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25199, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.216.149.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:54:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:55:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33569, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:56:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:57:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33511, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.89.198.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:56:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:56:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16752, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.126.106.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T07:57:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T07:57:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24652, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.244", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:02:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:02:33Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33395, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "118.33.73.177", "classifications": [], "first_seen": { "$date": "2023-06-28T10:10:55Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T10:10:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 41, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.133.20.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:04:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:04:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16674, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:10:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:11:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33332, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.236.22.59", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:11:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:11:57Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33217, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "80.120.241.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:14:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:14:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16937, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.194.216.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:30:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:30:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16398, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:33:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:33:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32735, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:36:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:36:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.248.41.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:37:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:37:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16334, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.144.251.16", "classifications": [], "first_seen": { "$date": "2023-06-28T11:05:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:05:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 51, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.66.50.94", "classifications": [], "first_seen": { "$date": "2023-06-28T11:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:06:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 8", "ET 3CORESec Poor Reputation IP group 2" ], "sightings": 78, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "46.101.123.135", "classifications": [], "first_seen": { "$date": "2023-06-28T11:08:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:08:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 159" ], "sightings": 39, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "61.7.147.42", "classifications": [], "first_seen": { "$date": "2023-06-28T11:24:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:24:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 39, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "45.79.250.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:43:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:52:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30748, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.133.5.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:46:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:46:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16217, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.80.92.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:47:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:47:25Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "(sip) method is unknown", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38605, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "35.203.211.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:48:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:49:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 43393, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.116.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:49:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:52:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31802, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.140.31.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T08:59:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T08:59:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 16089, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.197.182", "classifications": [], "first_seen": { "$date": "2023-06-28T11:39:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T12:26:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 753, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.161.65.145", "classifications": [], "first_seen": { "$date": "2023-06-28T11:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:55:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 114, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.119.81.249", "classifications": [], "first_seen": { "$date": "2023-06-28T11:43:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:43:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 155" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "160.154.0.244", "classifications": [], "first_seen": { "$date": "2023-06-28T11:51:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T11:51:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 38, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "87.236.176.123", "classifications": [], "first_seen": { "$date": "2023-06-28T12:00:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T12:02:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 114, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "108.252.209.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:13:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:48:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 238954, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.161.65.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:13:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:33:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 63577, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "67.220.244.191", "classifications": [], "first_seen": { "$date": "2023-06-28T12:17:30Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-29T12:17:23Z" }, "ports": [ 39408, 56618, 44756, 47460, 34270, 58522 ], "reporting_nodes": 1, "rules": [], "sightings": 90, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "68.183.208.167", "classifications": [], "first_seen": { "$date": "2023-06-28T12:45:51Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:30:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 701, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.177.140.175", "classifications": [], "first_seen": { "$date": "2023-06-28T12:50:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:35:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 666, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.153.192.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:15:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:29:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 71587, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.133.141.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:15:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:29:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 63645, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:16:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:16:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31932, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.5.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:16:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:32:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 119386, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.105.29.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:16:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:57:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 79346, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.88.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:17:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:34:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 119244, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.73.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:17:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:32:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 95368, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.37.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:19:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:31:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 95366, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.194.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:20:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:35:13Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90621, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:22:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:23:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31835, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "151.106.35.190", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:24:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:24:06Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 82430, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "8.222.216.254", "classifications": [], "first_seen": { "$date": "2023-06-28T12:57:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:14:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 630, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "102.217.123.243", "classifications": [], "first_seen": { "$date": "2023-06-28T12:58:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:50:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 1", "ET SCAN Potential SSH Scan" ], "sightings": 1702, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "147.182.242.98", "classifications": [], "first_seen": { "$date": "2023-06-28T12:59:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:36:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 734, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.157.153.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T13:02:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:32:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 723, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.168.95.50", "classifications": [], "first_seen": { "$date": "2023-06-28T13:20:12Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:24:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 1470, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "59.19.54.199", "classifications": [], "first_seen": { "$date": "2023-06-28T13:34:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:34:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 56" ], "sightings": 35, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.153.124.128", "classifications": [], "first_seen": { "$date": "2023-06-28T13:35:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:15:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 680, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.222.161.116", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:34:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:34:55Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31722, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.156.240.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:35:39Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:53:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 110295, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "78.153.130.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:37:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:47:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 71189, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:41:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:41:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32279, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:41:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:41:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15846, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.205.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:42:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:51:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54973, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.232.120.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:42:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:10:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 31196, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.126.11.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:43:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:59:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 78073, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.80.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T13:36:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:53:44Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3361, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.185.159.124", "classifications": [], "first_seen": { "$date": "2023-06-28T13:39:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:39:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 48" ], "sightings": 34, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "165.227.147.215", "classifications": [], "first_seen": { "$date": "2023-06-28T13:39:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:39:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 34, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "34.101.245.3", "classifications": [], "first_seen": { "$date": "2023-06-28T13:39:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:27:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 642, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.99.89.165", "classifications": [], "first_seen": { "$date": "2023-06-28T13:41:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:19:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 77", "ET SCAN Potential SSH Scan" ], "sightings": 1763, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "134.122.121.162", "classifications": [], "first_seen": { "$date": "2023-06-28T13:43:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:36:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 709, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "81.0.57.187", "classifications": [], "first_seen": { "$date": "2023-06-28T13:54:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T13:54:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 180" ], "sightings": 34, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.138.132.164", "classifications": [], "first_seen": { "$date": "2023-06-28T13:59:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:39:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 671, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.53.87.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T14:01:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:14:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 225, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.102.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T09:46:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:55:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62659, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.147.86.35", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:50:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:50:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 39881, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T09:56:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T09:56:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15506, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.107", "classifications": [], "first_seen": { "$date": "2023-06-28T14:16:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:16:14Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 33, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "138.197.15.182", "classifications": [], "first_seen": { "$date": "2023-06-28T14:50:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T14:50:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 33, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "20.235.121.96", "classifications": [], "first_seen": { "$date": "2023-06-28T15:01:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T15:49:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 118", "ET SCAN Potential SSH Scan" ], "sightings": 1666, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "112.5.3.230", "classifications": [], "first_seen": { "$date": "2023-06-28T10:16:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:16:07Z" }, "ports": [ 1713, 14949, 62846, 28075, 37353, 55411 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 8508, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.90.160.133", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:19:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:26:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 53286, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.90.160.134", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:19:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:26:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 53404, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.90.160.130", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:19:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:26:40Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 53400, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.98.59.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:20:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:44:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52791, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.95", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:20:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:20:02Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30528, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "204.42.253.130", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:40:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:40:51Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60256, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:41:30Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:41:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15068, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.219.94.4", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:47:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:47:36Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22506, "tags": [ "udp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "104.168.59.38", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:48:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:48:24Z" }, "ports": [ 65476, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22783, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.64", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:55:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T10:55:13Z" }, "ports": [ 53, 0, 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 22400, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "139.162.201.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T10:58:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:50:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 29423, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "135.125.68.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T11:10:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:10:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 33214, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "76.28.20.79", "classifications": [], "first_seen": { "$date": "2023-06-28T18:15:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T18:15:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 58, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.4p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "202.134.18.30", "classifications": [], "first_seen": { "$date": "2023-06-28T18:22:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T19:14:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 605, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.155.182.237", "classifications": [], "first_seen": { "$date": "2023-06-28T18:48:34Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T19:33:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 540, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.135.153.21", "classifications": [], "first_seen": { "$date": "2023-06-28T18:49:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T18:51:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 1276, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "198.235.24.243", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-28T11:16:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:16:12Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 14743, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.235.24.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T11:24:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:24:58Z" }, "ports": [ 5632, 0 ], "reporting_nodes": 1, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21963, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "85.221.184.197", "classifications": [], "first_seen": { "$date": "2023-06-28T19:13:55Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T19:15:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 2016, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.156.240.213", "classifications": [], "first_seen": { "$date": "2023-06-28T19:20:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T20:03:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 545, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "149.202.2.119", "classifications": [], "first_seen": { "$date": "2023-06-28T19:25:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T20:06:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 756, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "95.251.226.174", "classifications": [], "first_seen": { "$date": "2023-06-28T20:03:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T20:03:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 27, "tags": [ "ssh", "tcp", "ssh", "libssh-0.5.2", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "38.54.59.67", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T11:45:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:45:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 36555, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.236.29.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T11:52:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:11:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 93281, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.152.206.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T11:52:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:10:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 93281, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.87.253.114", "classifications": [], "first_seen": { "$date": "2023-06-28T20:58:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T20:58:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 26, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "77.173.11.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T11:56:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:11:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 85939, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "31.220.83.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T11:57:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:57:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14438, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T11:58:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T11:58:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14412, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.211", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-28T12:00:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:00:20Z" }, "ports": [ 1434, 0, 53 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 21731, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "129.226.95.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T12:08:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:22:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56562, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.122.174.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T12:09:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:27:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 84586, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.137.205.59", "classifications": [], "first_seen": { "$date": "2023-06-28T21:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T21:20:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 24" ], "sightings": 25, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.49.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T21:22:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:30:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 57", "ET 3CORESec Poor Reputation IP group 15", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 127504, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "43.159.59.118", "classifications": [], "first_seen": { "$date": "2023-06-28T21:22:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T22:09:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 493, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "141.98.11.158", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T21:35:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:22:01Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4836, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.236.38.199", "classifications": [], "first_seen": { "$date": "2023-06-28T21:45:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T21:45:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 25, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "198.235.24.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:54:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:29:41Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "ssh", "tcp", "ssh", "ZGrab", "ssh", "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "199.19.226.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T12:14:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:28:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 84486, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.219.93.189", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:15:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:15:05Z" }, "ports": [ 162, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21282, "tags": [ "udp", "snmptrap", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.125.48.145", "classifications": [], "first_seen": { "$date": "2023-06-28T12:16:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:16:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 14153, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "193.107.23.114", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:18:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:18:48Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41719, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.221.252.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T22:28:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:57:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10250, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.143.54", "classifications": [], "first_seen": { "$date": "2023-06-28T22:28:52Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T22:28:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 23, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.172.142.20", "classifications": [], "first_seen": { "$date": "2023-06-28T22:31:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T22:31:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 74" ], "sightings": 23, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.59.212.78", "classifications": [], "first_seen": { "$date": "2023-06-28T22:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T23:10:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 483, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.236.222.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T22:34:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SURICATA TCPv4 invalid checksum", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.190.193.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:23:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:23:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14045, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.10.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:29:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:29:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27143, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.109.127.209", "classifications": [], "first_seen": { "$date": "2023-06-28T23:26:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T23:33:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan", "SURICATA STREAM reassembly overlap with different data" ], "sightings": 374, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "47.236.25.121", "classifications": [], "first_seen": { "$date": "2023-06-28T23:38:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T23:38:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 22, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "89.248.165.245", "classifications": [], "first_seen": { "$date": "2023-06-28T23:42:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:19:30Z" }, "ports": [ 22, 8113, 8612, 8527, 8430, 9730, 9112, 8495 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "(port_scan) TCP portscan" ], "sightings": 38491, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "121.40.110.251", "classifications": [], "first_seen": { "$date": "2023-06-28T23:43:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-28T23:44:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 638, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "95.143.188.227", "classifications": [], "first_seen": { "$date": "2023-06-29T00:24:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T00:24:37Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 22, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "172.104.131.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:37:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:37:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14445, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.133.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:48:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:30:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23190, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.179.172.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:49:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:49:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13698, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.42.109.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:56:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:56:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13684, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.135.41.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T12:57:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:16:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 88539, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "153.139.182.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T12:57:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T12:57:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16064, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.174.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T12:59:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:12:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68238, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.34.202", "classifications": [], "first_seen": { "$date": "2023-06-29T00:43:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T01:21:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62", "ET SCAN Potential SSH Scan" ], "sightings": 1008, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "217.218.56.142", "classifications": [], "first_seen": { "$date": "2023-06-29T00:46:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T00:46:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 29" ], "sightings": 21, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.222.202.25", "classifications": [], "first_seen": { "$date": "2023-06-29T01:31:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T01:31:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 27, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "14.63.221.137", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T13:00:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:14:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 81714, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.190.119.189", "classifications": [], "first_seen": { "$date": "2023-06-28T13:07:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:07:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 6822, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "102.165.23.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:07:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:15:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27046, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.141.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:09:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:09:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.11.232.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:10:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:10:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13692, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.77.225.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:13:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:13:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13538, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.38.45.210", "classifications": [], "first_seen": { "$date": "2023-06-29T01:57:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T02:47:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 1264, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "8.222.196.120", "classifications": [], "first_seen": { "$date": "2023-06-29T02:19:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T02:23:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 260, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "14.204.44.27", "classifications": [], "first_seen": { "$date": "2023-06-29T02:30:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T02:30:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 38, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "183.191.30.147", "classifications": [], "first_seen": { "$date": "2023-06-29T02:33:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T02:33:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 19, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "143.198.20.105", "classifications": [], "first_seen": { "$date": "2023-06-29T02:36:02Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T03:24:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 399, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "146.190.98.191", "classifications": [], "first_seen": { "$date": "2023-06-29T03:07:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T03:12:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 836, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "67.78.100.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:20:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:12:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24824, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.232.89", "classifications": [], "first_seen": { "$date": "2023-06-28T13:28:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:28:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 6698, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "211.243.133.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:29:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:29:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 80357, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.164.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:29:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:29:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13392, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "173.255.201.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:32:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:18:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.119.199.54", "classifications": [], "first_seen": { "$date": "2023-06-29T04:17:25Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-29T04:17:25Z" }, "ports": [ 59992, 39720 ], "reporting_nodes": 1, "rules": [], "sightings": 24, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "60.220.185.22", "classifications": [], "first_seen": { "$date": "2023-06-29T05:15:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T07:12:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 40", "SURICATA TCPv4 invalid checksum", "SURICATA STREAM Last ACK with wrong seq" ], "sightings": 1535, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "190.104.25.221", "classifications": [], "first_seen": { "$date": "2023-06-29T05:21:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T05:21:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 101", "ET 3CORESec Poor Reputation IP group 23" ], "sightings": 36, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "125.131.142.234", "classifications": [], "first_seen": { "$date": "2023-06-29T05:22:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T06:03:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 500, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "13.48.1.155", "classifications": [], "first_seen": { "$date": "2023-06-29T05:29:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T05:29:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 18, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "3.0.49.183", "classifications": [], "first_seen": { "$date": "2023-06-29T05:46:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T05:48:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 935, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "183.105.236.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T13:55:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:55:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13307, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.23.170.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T13:55:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T13:55:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13313, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.86.12.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T05:58:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:31:24Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 40", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 745, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "170.64.132.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:01:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:01:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13267, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.76.115.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:04:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:04:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13249, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.51.181.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:07:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:07:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13238, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.93.233.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:09:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:42:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 83195, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.165.27", "classifications": [], "first_seen": { "$date": "2023-06-29T06:50:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T07:07:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 150, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "209.38.242.67", "classifications": [], "first_seen": { "$date": "2023-06-29T06:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T07:29:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 345, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.117.174", "classifications": [], "first_seen": { "$date": "2023-06-29T07:28:12Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T08:05:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 345, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "20.63.105.96", "classifications": [], "first_seen": { "$date": "2023-06-29T07:30:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T08:14:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 330, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "213.5.130.61", "classifications": [ "Misc activity", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-06-28T14:25:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:25:34Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 66610, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.243", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:27:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:27:05Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19590, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "59.11.26.112", "classifications": [], "first_seen": { "$date": "2023-06-28T14:28:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:28:37Z" }, "ports": [ 20556 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 6519, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "102.68.141.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T09:40:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:30:41Z" }, "ports": [ 22 ], "reporting_nodes": 3, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 1", "ET 3CORESec Poor Reputation IP group 1", "(stream_tcp) reset outside window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1191, "tags": [ "alert", "tcp", "ssh", "OpenSSH" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "194.233.166.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:42:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:17:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23875, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.126.10.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:44:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:05:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27204, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.92.191.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:53:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T14:53:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12876, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.159.93.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T14:55:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:25:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.191.10.49", "classifications": [], "first_seen": { "$date": "2023-06-29T10:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T11:08:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 390, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.144.28.193", "classifications": [], "first_seen": { "$date": "2023-06-29T10:25:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T11:03:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 273, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.189.167.109", "classifications": [], "first_seen": { "$date": "2023-06-29T10:29:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T10:29:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 13, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "205.210.31.235", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T10:51:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:59:06Z" }, "ports": [ 80, 53, 0 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3091, "tags": [ "alert", "tcp", "http", "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.142.125.223", "classifications": [], "first_seen": { "$date": "2023-06-29T10:57:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T10:57:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 13, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.77.172.96", "classifications": [], "first_seen": { "$date": "2023-06-29T11:14:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T11:16:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 572, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "52.119.199.68", "classifications": [], "first_seen": { "$date": "2023-06-29T11:17:21Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-06-30T05:17:21Z" }, "ports": [ 48758, 45898, 38878 ], "reporting_nodes": 1, "rules": [], "sightings": 31, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "94.113.219.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T11:18:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:20:49Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.128.163", "classifications": [], "first_seen": { "$date": "2023-06-29T11:22:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T11:23:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 129, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "170.64.132.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:03:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:03:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12857, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.10.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:03:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:42:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22641, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.91.83.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:11:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:11:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12795, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.52.0.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:14:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:14:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 71843, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.6.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:14:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:30:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21231, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.203.73.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T15:17:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:39:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 107746, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "66.220.9.122", "classifications": [], "first_seen": { "$date": "2023-06-28T15:19:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:19:22Z" }, "ports": [ 43766, 60026, 56270, 36902, 56642, 51960, 49187, 35942, 42765 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 7119, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "94.101.178.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T15:19:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:41:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44343, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.240.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T15:20:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:39:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 95036, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.185.153.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T15:25:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:26:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12688, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.96", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:27:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:27:56Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25375, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.246.208.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:29:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:29:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12685, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.132.200.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T15:29:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:46:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 69513, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.54.59.71", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-28T15:30:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:30:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 63423, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "8.222.158.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T15:31:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:44:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18970, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.133.34.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T15:33:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:45:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 64065, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "23.234.215.29", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T15:34:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:04:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 73891, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "74.217.179.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:35:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:13:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 45288, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.194.0.38", "classifications": [], "first_seen": { "$date": "2023-06-28T15:39:34Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:39:34Z" }, "ports": [ 4065, 12509 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 6419, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.231.35.151", "classifications": [], "first_seen": { "$date": "2023-06-29T11:33:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T11:53:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 72, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "222.102.193.176", "classifications": [], "first_seen": { "$date": "2023-06-29T12:10:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T12:10:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.137.14.117", "classifications": [], "first_seen": { "$date": "2023-06-29T12:23:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T12:23:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 24, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "45.66.230.26", "classifications": [], "first_seen": { "$date": "2023-06-29T12:23:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T12:23:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "113.53.42.230", "classifications": [], "first_seen": { "$date": "2023-06-29T12:23:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T12:23:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "148.72.245.17", "classifications": [], "first_seen": { "$date": "2023-06-29T12:48:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T12:48:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.189.167.155", "classifications": [], "first_seen": { "$date": "2023-06-29T13:23:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T13:23:35Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 12, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "49.165.226.71", "classifications": [], "first_seen": { "$date": "2023-06-29T13:56:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T13:56:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 36, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "59.1.178.195", "classifications": [], "first_seen": { "$date": "2023-06-29T14:28:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T14:28:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 47" ], "sightings": 24, "tags": [ "alert", "tcp", "ssh", "OpenSSH_8.2p1" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "1.116.155.191", "classifications": [], "first_seen": { "$date": "2023-06-29T15:25:00Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T15:25:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "49.144.166.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:50:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:50:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12464, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.14.183.39", "classifications": [], "first_seen": { "$date": "2023-06-28T15:52:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:52:04Z" }, "ports": [ 51194, 56435, 57043, 59253, 42328, 34840 ], "reporting_nodes": 1, "rules": [ "(port_scan) UDP filtered portsweep" ], "sightings": 6528, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "173.214.27.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T15:55:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T15:55:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 55382, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.196.48", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-28T16:01:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:01:22Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 12171, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "185.11.211.89", "classifications": [], "first_seen": { "$date": "2023-06-28T16:06:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:06:09Z" }, "ports": [ 37691, 30594, 64638, 54829 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 6048, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "47.236.17.115", "classifications": [], "first_seen": { "$date": "2023-06-29T16:42:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:26:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 242, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "178.128.73.254", "classifications": [], "first_seen": { "$date": "2023-06-29T16:48:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:26:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 84", "ET SCAN Potential SSH Scan" ], "sightings": 550, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "37.152.179.162", "classifications": [], "first_seen": { "$date": "2023-06-29T16:49:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:42:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 143, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.222.195.128", "classifications": [], "first_seen": { "$date": "2023-06-29T16:53:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:08:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 143, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "20.203.247.157", "classifications": [], "first_seen": { "$date": "2023-06-29T17:06:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:07:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 352, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "51.89.238.20", "classifications": [], "first_seen": { "$date": "2023-06-29T17:14:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:23:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 330, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "27.54.184.10", "classifications": [], "first_seen": { "$date": "2023-06-29T17:38:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T17:53:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 136" ], "sightings": 22, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "1.181.69.30", "classifications": [], "first_seen": { "$date": "2023-06-29T18:02:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T18:05:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 33, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "192.155.88.231", "classifications": [], "first_seen": { "$date": "2023-06-29T18:22:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T18:26:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 33, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.225.108.41", "classifications": [], "first_seen": { "$date": "2023-06-29T18:54:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:00:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 495, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "112.5.144.252", "classifications": [], "first_seen": { "$date": "2023-06-29T19:17:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:47:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan" ], "sightings": 440, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.156.131.197", "classifications": [], "first_seen": { "$date": "2023-06-29T19:18:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:01:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 198, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.224.129.141", "classifications": [], "first_seen": { "$date": "2023-06-29T19:18:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:53:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 264, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "68.183.76.209", "classifications": [], "first_seen": { "$date": "2023-06-29T19:19:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:21:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 473, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "197.5.145.121", "classifications": [], "first_seen": { "$date": "2023-06-29T19:20:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:55:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 110" ], "sightings": 660, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.238.71.108", "classifications": [], "first_seen": { "$date": "2023-06-29T19:22:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:29:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 441, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "126.145.110.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T16:31:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:31:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11744, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.3.92.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T16:37:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:58:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 69350, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.4.236.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T16:37:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:37:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11665, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.110.229.27", "classifications": [], "first_seen": { "$date": "2023-06-29T19:40:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:43:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 44, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "137.184.54.207", "classifications": [], "first_seen": { "$date": "2023-06-29T19:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:11:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 34", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 616, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6", "anomaly" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "134.17.16.177", "classifications": [], "first_seen": { "$date": "2023-06-29T19:44:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:12:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 215, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.226.64.200", "classifications": [], "first_seen": { "$date": "2023-06-29T19:45:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:11:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET SCAN Potential SSH Scan" ], "sightings": 561, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6", "anomaly" ], "rule_count": 5, "classification_count": 0 }, { "ioc": "103.110.43.196", "classifications": [], "first_seen": { "$date": "2023-06-29T19:46:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T19:46:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 11, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.156.68.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T19:47:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:38:20Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 240, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.128.116.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T19:48:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:30:19Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 238, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.128.108.103", "classifications": [], "first_seen": { "$date": "2023-06-29T19:48:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:11:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 213, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "196.219.43.242", "classifications": [], "first_seen": { "$date": "2023-06-29T19:48:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:11:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner", "ET SCAN Potential SSH Scan" ], "sightings": 234, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert", "anomaly" ], "rule_count": 4, "classification_count": 0 }, { "ioc": "82.157.41.186", "classifications": [], "first_seen": { "$date": "2023-06-29T19:55:50Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T20:10:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "SURICATA Applayer Detect protocol only one direction", "APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION", "invalid_banner" ], "sightings": 891, "tags": [ "alert", "tcp", "ssh", "anomaly", "Go" ], "rule_count": 6, "classification_count": 0 }, { "ioc": "45.118.132.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T16:49:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:49:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14012, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "63.141.228.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T16:56:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T16:56:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11508, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.129.38.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T16:59:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:08:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22856, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.92.191.110", "classifications": [], "first_seen": { "$date": "2023-06-29T21:04:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T21:07:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 396, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "112.133.221.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T17:03:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:17:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68324, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.185.50.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:05:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:05:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 28536, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "35.203.211.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:08:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:08:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11391, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "199.195.248.109", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:08:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:13:35Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41568, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "112.163.202.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T17:11:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:12:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11376, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "208.124.163.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T17:12:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:13:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11369, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:14:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:14:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11370, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.60.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:15:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:15:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11402, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:17:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:14:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21835, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:21:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:21:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13278, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:21:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:21:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11420, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:27:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:39:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19327, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.33.141.18", "classifications": [], "first_seen": { "$date": "2023-06-28T17:28:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:28:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP redirect host", "ICMP Traffic Detected" ], "sightings": 11344, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.216.150.198", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:28:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:28:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11340, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:30:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:30:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11337, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:32:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:32:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11422, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.193.97.24", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T17:33:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:33:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11324, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:36:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:36:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11810, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:40:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:40:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11322, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.10.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:41:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:24:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21961, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "81.19.92.86", "classifications": [], "first_seen": { "$date": "2023-06-28T17:44:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:44:17Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 5635, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "69.49.245.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T17:45:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:01:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 72267, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.28.156.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:47:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T17:47:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22434, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.126.224.108", "classifications": [], "first_seen": { "$date": "2023-06-29T21:44:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T21:45:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 216, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "5.8.10.202", "classifications": [], "first_seen": { "$date": "2023-06-29T22:00:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T22:03:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 5", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 32, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "61.241.133.190", "classifications": [], "first_seen": { "$date": "2023-06-29T22:03:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T22:18:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 24, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.163.125.50", "classifications": [], "first_seen": { "$date": "2023-06-29T22:21:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T22:21:45Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 8, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.145.163.221", "classifications": [], "first_seen": { "$date": "2023-06-29T22:28:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:12:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 176, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.186.116.222", "classifications": [], "first_seen": { "$date": "2023-06-29T22:29:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:17:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 160, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "206.189.138.174", "classifications": [], "first_seen": { "$date": "2023-06-29T22:31:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T22:31:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 122" ], "sightings": 8, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.59.129.247", "classifications": [], "first_seen": { "$date": "2023-06-29T22:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:09:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 168, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "101.36.124.230", "classifications": [], "first_seen": { "$date": "2023-06-29T22:47:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T22:47:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "205.210.31.196", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:00:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:15:56Z" }, "ports": [ 80, 53, 0 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 23, "tags": [ "alert", "tcp", "http", "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.210.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T17:52:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:53:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22219, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.218.89.123", "classifications": [], "first_seen": { "$date": "2023-06-29T23:00:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:12:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 64, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.67.165.114", "classifications": [], "first_seen": { "$date": "2023-06-29T23:01:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:48:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 8", "ET SCAN Potential SSH Scan" ], "sightings": 408, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "186.28.2.115", "classifications": [], "first_seen": { "$date": "2023-06-29T23:01:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:42:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 128, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "209.141.60.201", "classifications": [], "first_seen": { "$date": "2023-06-29T23:02:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:45:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 160, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.154.90.94", "classifications": [], "first_seen": { "$date": "2023-06-29T23:02:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:43:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 160, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.153.72.112", "classifications": [], "first_seen": { "$date": "2023-06-29T23:03:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:41:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 176, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "188.120.249.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:04:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:13:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8282, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.251.102.74", "classifications": [], "first_seen": { "$date": "2023-06-29T23:04:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:04:07Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 12" ], "sightings": 8, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "181.228.116.172", "classifications": [], "first_seen": { "$date": "2023-06-29T23:05:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:55:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 160, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "210.209.125.246", "classifications": [], "first_seen": { "$date": "2023-06-29T23:11:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T00:00:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 143, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "18.215.245.30", "classifications": [], "first_seen": { "$date": "2023-06-29T23:51:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-29T23:51:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.216.150.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:00:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:00:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11046, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:08:55Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:08:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.42.10.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:18:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:34:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21893, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.39", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:20:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:20:13Z" }, "ports": [ 53, 0, 5632 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 16485, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.211.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:24:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:24:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10970, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.185.113.210", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:27:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:04:21Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 41114, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "34.126.116.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:34:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:34:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10964, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.217.137.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:39:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:39:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.212.157.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:39:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:39:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10886, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:40:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:40:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10896, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:45:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:45:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10918, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:50:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:50:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10831, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.148.22.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:54:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:54:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10830, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.19.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:54:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:10:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20732, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:56:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:56:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10830, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:58:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:58:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10826, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.107.4.187", "classifications": [], "first_seen": { "$date": "2023-06-28T18:58:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:58:14Z" }, "ports": [ 17526, 32519 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 5415, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.149.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T18:59:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T18:59:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10838, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.195.242.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:00:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:00:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13269, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.94.98.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:02:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:03:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 57783, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:02:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:02:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12088, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.234.110.195", "classifications": [], "first_seen": { "$date": "2023-06-28T19:03:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:03:09Z" }, "ports": [ 5456, 11403 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 5482, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "205.210.31.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:07:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:07:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10782, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:09:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:09:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10802, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "75.46.137.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:10:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:10:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10744, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.55.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:15:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:25:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21090, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:16:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:16:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10686, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "154.62.107.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:17:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:17:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10685, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:18:12Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:18:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10733, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:19:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:19:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10672, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.173.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T19:20:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:36:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 53176, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:21:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:21:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10664, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.246.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T19:21:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:34:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 58495, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:29:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:29:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14375, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:29:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:29:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13653, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.214", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:35:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:35:58Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15913, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.203.210.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:39:22Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:39:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10600, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:46:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:46:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10594, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:48:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:48:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10592, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:50:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:50:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11279, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:52:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:52:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10567, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:55:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:55:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11823, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T19:59:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T19:59:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10590, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:00:00Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:00:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10553, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.159.59.216", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:01:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:57:05Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34246, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.149.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:16:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:16:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10466, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.224.128.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:16:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:44:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20242, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:16:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:16:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10463, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:19:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:19:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10446, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:22:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:22:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11580, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:25:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:25:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10390, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.140.39.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:25:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:25:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10390, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:25:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:25:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10398, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:29:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:29:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10394, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:29:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:29:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10334, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.175.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T20:30:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:30:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5154, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "42.240.133.52", "classifications": [ "Misc activity", "Decode of an RPC Query" ], "first_seen": { "$date": "2023-06-28T20:33:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:33:21Z" }, "ports": [ 0, 111 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-RPC portmap listing UDP 111" ], "sightings": 23229, "tags": [ "icmp", "udp", "sunrpc", "portmapper" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:33:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:33:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:34:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:23:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 21227, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.197", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:40:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:40:36Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5093, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:44:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:44:09Z" }, "ports": [ 5632, 0 ], "reporting_nodes": 1, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15206, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "35.203.211.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:44:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:44:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10164, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:49:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T20:49:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10969, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.116.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T20:56:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:09:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19663, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:01:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:01:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9986, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.141.213.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T21:10:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:10:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9896, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:20:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:20:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9828, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.217.26.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:27:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:27:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9798, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.116.163.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:31:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:31:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9798, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:38:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:38:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9800, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:40:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:40:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9793, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:43:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:43:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9838, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.199.82.183", "classifications": [], "first_seen": { "$date": "2023-06-28T21:46:28Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:46:28Z" }, "ports": [ 27353, 51556 ], "reporting_nodes": 2, "rules": [ "(tcp) XMAS attack detected", "(tcp) TCP SYN with RST", "(tcp) TCP SYN with FIN" ], "sightings": 14685, "tags": [ "tcp" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "35.203.210.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:50:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:50:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10049, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T21:57:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T21:57:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9747, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:00:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:00:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9714, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.178.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T22:10:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:24:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 57778, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.130.59.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T22:14:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:14:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9634, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.51.106.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T22:14:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:15:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9634, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.108", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:27:07Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:27:07Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14411, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "8.222.136.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T22:27:54Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:44:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47811, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.107.156.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T22:30:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:49:46Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 95947, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "97.74.95.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T22:34:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:45:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ET SCAN Potential SSH Scan" ], "sightings": 38248, "tags": [ "tcp", "ssh", "libssh_0.9.6", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:38:48Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:38:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9612, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:43:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:43:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:47:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:47:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9562, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.226.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:48:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:48:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9536, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.240.129.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:50:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:50:38Z" }, "ports": [ 0, 7001 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "POLICY-OTHER AFS access" ], "sightings": 13704, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "137.184.66.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:51:26Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:51:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11130, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:52:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:52:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9588, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:56:03Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:56:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T22:57:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T22:57:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.228.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T23:00:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:19:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60605, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:09:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:09:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12692, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:11:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:11:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9392, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.197.184.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:11:15Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:11:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:14:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:14:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9296, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.196.189.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:15:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:15:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9292, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.113.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:18:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:18:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9220, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:20:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:20:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9170, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:24:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9060, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:28:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:28:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:32:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:32:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9150, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.189.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T23:33:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:51:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35253, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.226.110.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T23:34:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:47:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22094, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "120.204.196.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:35:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:35:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12233, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.201.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:36:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:36:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8903, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:36:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:36:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8993, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.244.77.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T23:37:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:50:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30776, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "144.126.194.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T23:40:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:56:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56930, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:41:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:41:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8840, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:42:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:42:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8820, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.159.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:42:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:42:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10392, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.242.86.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:42:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:42:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8817, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.149.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T23:42:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:58:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48058, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.227.172.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T23:43:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:04:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 74132, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.190.22.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-28T23:44:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:46:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8788, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:45:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:45:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 11210, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.102.83", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:48:44Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:48:44Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13151, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.55.0.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:50:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:50:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8752, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:51:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:51:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8740, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.55.195.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-28T23:56:58Z" }, "ja3": [], "last_seen": { "$date": "2026-06-28T23:56:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8698, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:00:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:00:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8685, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.140.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:02:04Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:02:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8663, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.165.193.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:03:49Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:03:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17324, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:07:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:07:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8656, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:07:31Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:07:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8656, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.142.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T00:09:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:22:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 38796, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:11:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:11:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.73.128.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:12:53Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:12:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:14:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:14:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8777, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.122", "classifications": [ "Detection of a Network Scan", "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-06-29T00:17:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:17:36Z" }, "ports": [ 1900, 0, 69 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 25834, "tags": [ "udp", "icmp", "tftp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "146.88.241.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:17:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:41:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28224, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.97.66.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T00:19:33Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:19:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8606, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:20:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:20:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8602, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.133.39.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:25:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:25:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8579, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:25:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:25:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8560, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "3.233.224.166", "classifications": [], "first_seen": { "$date": "2023-06-29T00:27:20Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:27:20Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4268, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.55.196.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:28:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:28:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8515, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:30:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:30:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8482, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:32:02Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:32:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8582, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.22", "classifications": [ "Attempted Information Leak", "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-06-29T00:36:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:21:20Z" }, "ports": [ 161, 0, 1900 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 39244, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "35.203.210.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:36:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:36:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9415, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:40:01Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:40:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8316, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.205.5.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:41:10Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:41:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12256, "tags": [ "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.235.24.83", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:54:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:27:01Z" }, "ports": [ 22, 53, 0, 1434 ], "reporting_nodes": 3, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 58, "tags": [ "ssh", "tcp", "ssh", "ZGrab", "ssh", "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "207.154.196.132", "classifications": [], "first_seen": { "$date": "2023-06-30T01:07:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T01:46:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 147, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.227.129.83", "classifications": [], "first_seen": { "$date": "2023-06-30T01:12:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:00:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 119, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "78.195.6.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T01:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:40:25Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 177, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.78.177.178", "classifications": [], "first_seen": { "$date": "2023-06-30T01:44:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:34:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 147, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "115.132.124.236", "classifications": [], "first_seen": { "$date": "2023-06-30T01:45:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:32:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 140, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.149.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:57:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:57:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8141, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.2.105.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T02:14:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:40:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 600, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "86.129.106.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T00:58:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T00:58:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20322, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "146.88.241.32", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-06-29T00:58:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:20:30Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 21356, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "54.154.229.21", "classifications": [], "first_seen": { "$date": "2023-06-30T02:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:52:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 210, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "217.144.54.142", "classifications": [], "first_seen": { "$date": "2023-06-30T02:18:34Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:36:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 49, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "119.18.55.21", "classifications": [], "first_seen": { "$date": "2023-06-30T02:19:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T03:02:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 140, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "212.72.157.84", "classifications": [], "first_seen": { "$date": "2023-06-30T02:19:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:58:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 147, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "179.43.190.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:02:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:02:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8258, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.232", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T01:05:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:05:09Z" }, "ports": [ 0, 22 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8123, "tags": [ "icmp", "tcp", "ssh" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "146.88.241.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:09:23Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:54:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 19124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:11:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:11:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 25582, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:12:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:12:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8087, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.133.33.240", "classifications": [], "first_seen": { "$date": "2023-06-30T02:27:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T03:14:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 147, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.245.107.128", "classifications": [], "first_seen": { "$date": "2023-06-30T02:28:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:28:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET 3CORESec Poor Reputation IP group 15" ], "sightings": 7, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "5.182.207.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:19:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:19:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10314, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.24.180.82", "classifications": [], "first_seen": { "$date": "2023-06-30T02:29:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T02:29:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 7, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.150.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:20:36Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:20:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.78", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:24:38Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:24:38Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6640, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.150.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:34:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:34:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7992, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:43:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:13:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18971, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:48:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:48:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8531, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:48:41Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:48:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7959, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T01:58:57Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T01:58:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7881, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:00:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:21:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 17050, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.196.95.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:01:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:01:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7862, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.224.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:06:11Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:06:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7752, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.159.56.183", "classifications": [], "first_seen": { "$date": "2023-06-30T03:07:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T03:10:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 133, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "139.162.170.253", "classifications": [], "first_seen": { "$date": "2023-06-30T03:57:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T04:36:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 154, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "46.114.94.59", "classifications": [], "first_seen": { "$date": "2023-06-30T03:59:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T04:36:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 210, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "46.101.62.196", "classifications": [], "first_seen": { "$date": "2023-06-30T03:59:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T03:59:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 160" ], "sightings": 7, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "129.226.55.153", "classifications": [], "first_seen": { "$date": "2023-06-30T03:59:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T04:19:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Last ACK with wrong seq" ], "sightings": 77, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "51.145.172.105", "classifications": [], "first_seen": { "$date": "2023-06-30T04:01:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T04:18:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 63, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "20.123.111.79", "classifications": [], "first_seen": { "$date": "2023-06-30T04:03:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T04:47:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA STREAM 3way handshake SYN resend different seq on SYN recv", "SURICATA STREAM 3way handshake SYNACK resend with different ack" ], "sightings": 1603, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "162.216.149.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:10:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:10:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7664, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:11:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:11:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8634, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:13:35Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:13:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7628, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:14:27Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:14:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9817, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.56.111.60", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-29T02:31:42Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:31:42Z" }, "ports": [ 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 5567, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.237.97.227", "classifications": [], "first_seen": { "$date": "2023-06-29T02:32:19Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:32:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 7068, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "35.203.210.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:34:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:34:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7045, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.127.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:42:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:42:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6999, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:43:56Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:43:56Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 6949, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "82.209.201.104", "classifications": [], "first_seen": { "$date": "2023-06-29T02:45:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:45:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication administratively prohibited", "ICMP Traffic Detected" ], "sightings": 6865, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "13.75.73.10", "classifications": [], "first_seen": { "$date": "2023-06-30T05:24:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T05:24:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "175.192.130.68", "classifications": [], "first_seen": { "$date": "2023-06-30T05:32:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T05:32:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "OpenSSH_8.2p1", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "8.219.232.199", "classifications": [], "first_seen": { "$date": "2023-06-30T05:36:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T05:36:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 56, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "184.105.247.198", "classifications": [], "first_seen": { "$date": "2023-06-30T05:53:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T05:53:22Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM Packet with invalid ack", "SURICATA STREAM SHUTDOWN RST invalid ack" ], "sightings": 14, "tags": [ "alert", "tcp", "http" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "95.143.188.81", "classifications": [], "first_seen": { "$date": "2023-06-30T06:05:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T06:05:42Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 7, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "142.93.209.170", "classifications": [], "first_seen": { "$date": "2023-06-30T06:33:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:13:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 43" ], "sightings": 420, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "193.194.92.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T06:35:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:10:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8732, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.187.147.100", "classifications": [], "first_seen": { "$date": "2023-06-30T06:35:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T06:56:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 63, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "91.196.165.8", "classifications": [], "first_seen": { "$date": "2023-06-30T06:37:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:15:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 147, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "188.165.37.1", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:47:24Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:47:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8295, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.218.206.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:48:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:48:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6792, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.152.52.204", "classifications": [], "first_seen": { "$date": "2023-06-30T06:51:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T06:51:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 7, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "64.20.145.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:53:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:53:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6665, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.124.214.10", "classifications": [], "first_seen": { "$date": "2023-06-30T07:13:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:31:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 132", "ET SCAN Potential SSH Scan" ], "sightings": 330, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.156.4.142", "classifications": [], "first_seen": { "$date": "2023-06-30T07:13:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:32:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 139, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "207.154.251.172", "classifications": [], "first_seen": { "$date": "2023-06-30T07:13:55Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:32:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 195, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "157.230.125.144", "classifications": [], "first_seen": { "$date": "2023-06-30T07:15:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:32:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 54", "ET SCAN Potential SSH Scan" ], "sightings": 308, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.216.150.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:58:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:58:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6491, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.5.129.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T02:58:21Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T02:58:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6429, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.71.146.167", "classifications": [], "first_seen": { "$date": "2023-06-30T07:47:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:52:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "SURICATA TCPv4 invalid checksum" ], "sightings": 384, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "42.203.23.174", "classifications": [], "first_seen": { "$date": "2023-06-30T08:25:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:28:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM CLOSEWAIT FIN out of window" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "65.49.1.39", "classifications": [], "first_seen": { "$date": "2023-06-30T08:26:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:26:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 12, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "67.220.243.234", "classifications": [], "first_seen": { "$date": "2023-06-30T09:17:29Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-07-01T06:17:26Z" }, "ports": [ 60232, 42120, 42114 ], "reporting_nodes": 1, "rules": [], "sightings": 13, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "95.143.188.146", "classifications": [], "first_seen": { "$date": "2023-06-30T09:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:43:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "23.236.169.232", "classifications": [], "first_seen": { "$date": "2023-06-30T10:08:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:47:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 132, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "212.50.255.183", "classifications": [], "first_seen": { "$date": "2023-06-30T11:06:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:53:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 120, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "64.227.182.117", "classifications": [], "first_seen": { "$date": "2023-06-30T11:09:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:09:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 172" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "221.215.44.18", "classifications": [], "first_seen": { "$date": "2023-06-30T11:43:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:43:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "8.219.240.191", "classifications": [], "first_seen": { "$date": "2023-06-30T11:47:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:01:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 108, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.99.91.35", "classifications": [], "first_seen": { "$date": "2023-06-30T12:16:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:18:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 270, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "202.28.120.119", "classifications": [], "first_seen": { "$date": "2023-06-30T13:21:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:25:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 18, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "195.87.80.171", "classifications": [], "first_seen": { "$date": "2023-06-30T14:46:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:23:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 132, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "150.109.5.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:09:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:27:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 146, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.158.5.10", "classifications": [], "first_seen": { "$date": "2023-06-30T15:12:32Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:57:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 120, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "177.220.155.34", "classifications": [], "first_seen": { "$date": "2023-06-30T15:20:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:20:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "177.17.229.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:04:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:18:36Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.247.184.181", "classifications": [], "first_seen": { "$date": "2023-06-30T16:07:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:07:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "159.65.55.28", "classifications": [], "first_seen": { "$date": "2023-06-30T17:28:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:09:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 62", "ET SCAN Potential SSH Scan" ], "sightings": 288, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "54.37.228.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T17:29:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:49:54Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 177, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.178.161.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T17:29:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:27:57Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 174", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 362, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "47.254.134.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T17:31:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:31:12Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 180, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.138.100.126", "classifications": [], "first_seen": { "$date": "2023-06-30T17:32:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:48:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 18, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.28.23.98", "classifications": [], "first_seen": { "$date": "2023-06-30T17:32:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:14:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 114, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "20.193.148.6", "classifications": [], "first_seen": { "$date": "2023-06-30T17:33:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:33:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 116" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "167.172.164.121", "classifications": [], "first_seen": { "$date": "2023-06-30T17:33:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:10:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 126, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "170.106.141.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T17:34:08Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:31:38Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21094, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.162.37.27", "classifications": [], "first_seen": { "$date": "2023-06-30T17:34:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:34:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh-0.6.3", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "112.161.214.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T17:35:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:25:28Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16", "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 303, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "23.95.164.237", "classifications": [], "first_seen": { "$date": "2023-06-30T18:17:59Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:17:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 134" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "3.215.125.249", "classifications": [], "first_seen": { "$date": "2023-06-30T18:22:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:01:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 42, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "114.252.40.1", "classifications": [], "first_seen": { "$date": "2023-06-30T18:44:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:44:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "193.163.125.70", "classifications": [], "first_seen": { "$date": "2023-06-30T18:49:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:49:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET DROP Dshield Block Listed Source group 1" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "209.15.112.146", "classifications": [], "first_seen": { "$date": "2023-06-30T19:12:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:12:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "167.99.208.65", "classifications": [], "first_seen": { "$date": "2023-06-30T19:14:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:51:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 120, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "124.222.66.99", "classifications": [], "first_seen": { "$date": "2023-06-30T19:23:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:23:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "190.145.172.114", "classifications": [], "first_seen": { "$date": "2023-06-30T19:57:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:57:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 102" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "45.88.8.95", "classifications": [], "first_seen": { "$date": "2023-06-30T20:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:48:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 120, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "95.167.221.138", "classifications": [], "first_seen": { "$date": "2023-06-30T20:22:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:00:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 129, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.222.128.194", "classifications": [], "first_seen": { "$date": "2023-06-30T20:23:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:39:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 42, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.199.97.42", "classifications": [], "first_seen": { "$date": "2023-06-30T20:25:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:14:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139", "ET SCAN Potential SSH Scan" ], "sightings": 276, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "210.196.70.124", "classifications": [], "first_seen": { "$date": "2023-06-30T20:26:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:06:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 116, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "187.157.135.152", "classifications": [], "first_seen": { "$date": "2023-06-30T20:27:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:06:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 96", "ET 3CORESec Poor Reputation IP group 23", "ET SCAN Potential SSH Scan" ], "sightings": 300, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "117.197.9.14", "classifications": [], "first_seen": { "$date": "2023-06-30T20:31:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:36:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "157.38.248.19", "classifications": [], "first_seen": { "$date": "2023-06-30T20:39:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:39:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 6, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.226.26.250", "classifications": [], "first_seen": { "$date": "2023-06-30T20:54:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:35:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 91, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "216.218.206.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:06:43Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:06:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4084, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:08:13Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:08:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4043, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.96.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:09:17Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:09:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4035, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.143.99.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:10:32Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:10:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3968, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "12.238.55.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T03:10:46Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:29:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21612, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:16:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:16:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 7316, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:16:45Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:16:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13817, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.93.50.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T03:16:59Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:27:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14348, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.128.95.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T03:17:50Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:32:37Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7084, "tags": [ "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.144.193.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T03:18:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:36:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 47209, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.32.7.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T03:18:52Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:34:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20614, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:20:18Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:20:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5300, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:23:09Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:23:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3556, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.159.145.58", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:23:25Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:23:25Z" }, "ports": [ 5082, 0, 6082, 6090, 5060 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10465, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "191.96.57.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T03:23:47Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:37:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 17951, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:24:14Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12592, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.115.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:26:06Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:26:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3432, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.210", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:27:05Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:27:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3431, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.233.232.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T03:27:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:37:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 23231, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:28:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:28:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3392, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.136.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:28:40Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:28:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5305, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.38.225.98", "classifications": [], "first_seen": { "$date": "2023-06-30T20:59:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:12:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 10, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "162.216.150.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:32:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:32:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:32:37Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:32:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4552, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.197.12.189", "classifications": [], "first_seen": { "$date": "2023-06-30T21:02:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:02:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "205.210.31.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:34:51Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:34:51Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4927, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.107.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:37:29Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:37:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3210, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.197.13.44", "classifications": [], "first_seen": { "$date": "2023-06-30T21:09:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:09:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "117.197.14.82", "classifications": [], "first_seen": { "$date": "2023-06-30T21:19:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:20:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM FIN out of window" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "119.18.55.47", "classifications": [], "first_seen": { "$date": "2023-06-30T21:21:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:00:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 106, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "128.199.154.5", "classifications": [], "first_seen": { "$date": "2023-06-30T21:23:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:09:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 25", "ET SCAN Potential SSH Scan" ], "sightings": 231, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "178.128.62.69", "classifications": [], "first_seen": { "$date": "2023-06-30T21:25:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:08:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 94, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "101.36.104.101", "classifications": [], "first_seen": { "$date": "2023-06-30T21:26:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:36:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 25, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "118.193.35.209", "classifications": [], "first_seen": { "$date": "2023-06-30T21:26:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:29:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 215, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "156.236.72.238", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T21:26:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET SCAN Potential SSH Scan", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 136, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.75.105.184", "classifications": [], "first_seen": { "$date": "2023-06-30T21:27:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:02:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 110, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "159.65.12.30", "classifications": [], "first_seen": { "$date": "2023-06-30T21:27:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:27:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 60" ], "sightings": 5, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "117.197.2.85", "classifications": [], "first_seen": { "$date": "2023-06-30T21:29:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:29:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 5, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.4.180.245", "classifications": [], "first_seen": { "$date": "2023-06-30T21:30:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:13:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 87, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "117.197.3.32", "classifications": [], "first_seen": { "$date": "2023-06-30T21:32:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:57:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA STREAM FIN out of window" ], "sightings": 24, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "157.38.253.225", "classifications": [], "first_seen": { "$date": "2023-06-30T21:52:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:02:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 12, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "117.197.5.17", "classifications": [], "first_seen": { "$date": "2023-06-30T21:59:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:59:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "117.197.5.121", "classifications": [], "first_seen": { "$date": "2023-06-30T22:06:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:06:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "42.248.126.138", "classifications": [], "first_seen": { "$date": "2023-06-30T22:29:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:10:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 240, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "189.57.151.124", "classifications": [], "first_seen": { "$date": "2023-06-30T23:38:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:21:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 90, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "103.2.233.237", "classifications": [], "first_seen": { "$date": "2023-06-30T23:38:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:38:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 7", "ET 3CORESec Poor Reputation IP group 2" ], "sightings": 6, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "8.219.243.203", "classifications": [], "first_seen": { "$date": "2023-06-30T23:39:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:51:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 182", "ET SCAN Potential SSH Scan" ], "sightings": 66, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "165.22.220.227", "classifications": [], "first_seen": { "$date": "2023-06-30T23:47:51Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:59:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 15, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "107.180.88.176", "classifications": [], "first_seen": { "$date": "2023-06-30T23:48:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:32:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 14", "ET SCAN Potential SSH Scan" ], "sightings": 147, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "185.74.5.184", "classifications": [], "first_seen": { "$date": "2023-06-30T23:50:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:37:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 94", "ET SCAN Potential SSH Scan" ], "sightings": 143, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "8.219.207.211", "classifications": [], "first_seen": { "$date": "2023-06-30T23:51:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:00:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 24, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "218.24.52.240", "classifications": [], "first_seen": { "$date": "2023-06-30T23:54:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:08:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum" ], "sightings": 9, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.240.204.250", "classifications": [], "first_seen": { "$date": "2023-06-30T23:54:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:54:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 139" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "111.93.165.35", "classifications": [], "first_seen": { "$date": "2023-07-01T01:11:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:14:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "123.58.197.78", "classifications": [], "first_seen": { "$date": "2023-07-01T01:13:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:13:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "83.235.21.252", "classifications": [], "first_seen": { "$date": "2023-07-01T01:13:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:17:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 4, "tags": [ "ssh", "tcp", "ssh", "libssh_0.7.4", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "67.220.245.24", "classifications": [], "first_seen": { "$date": "2023-07-01T01:17:25Z" }, "ja3": [ "3fed133de60c35724739b913924b6c24" ], "last_seen": { "$date": "2023-07-01T01:17:25Z" }, "ports": [ 37334 ], "reporting_nodes": 1, "rules": [], "sightings": 2, "tags": [ "tls", "tcp" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "185.18.212.107", "classifications": [], "first_seen": { "$date": "2023-07-01T01:19:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:55:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 40, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "175.101.3.66", "classifications": [], "first_seen": { "$date": "2023-07-01T01:22:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:54:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 60, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "111.40.121.69", "classifications": [], "first_seen": { "$date": "2023-07-01T01:43:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:46:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 56, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "192.241.134.164", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:50:16Z" }, "ja3": [], "last_seen": { "$date": "2026-06-29T03:50:16Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6952, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.149.223", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:58:22Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T03:58:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2612, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T03:59:32Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T03:59:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3491, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.30.64.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T03:59:38Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:01:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27392, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:00:43Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:00:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.5.156.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T04:00:59Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:00:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9770, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.206.128.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:02:36Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:02:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2468, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.30.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T04:03:32Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:03:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 35292, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:05:30Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:05:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2439, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.222.35.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:05:30Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:05:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2432, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:07:41Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:07:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2417, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:11:13Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:11:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2405, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.14", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:11:13Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:11:13Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3603, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.214.12", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:14:30Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:14:30Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3582, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.203.210.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:14:30Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:14:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3621, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.102.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:22:30Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:22:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2376, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:27:14Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:27:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2369, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.155.85.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:28:20Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:28:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4314, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:32:15Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:32:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2364, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:39:24Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:39:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2344, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:43:41Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:43:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2325, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.90", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-29T04:46:47Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:46:47Z" }, "ports": [ 5632, 0, 161 ], "reporting_nodes": 1, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 3839, "tags": [ "udp", "icmp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "162.216.149.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:48:07Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:48:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2483, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:51:05Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:51:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.122", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:52:49Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:52:49Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4864, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "88.174.139.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T04:53:14Z" }, "ja3": [], "last_seen": { "$date": "2025-06-29T04:53:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2244, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "84.32.188.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T04:59:26Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T04:59:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2194, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:04:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:04:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:08:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:08:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2182, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:12:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:12:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3182, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:12:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:12:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2128, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.158.134.106", "classifications": [], "first_seen": { "$date": "2023-06-29T05:13:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:13:16Z" }, "ports": [ 22267, 31194, 61107 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 1089, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.243.152.28", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:15:37Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:15:37Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4212, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.150.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:17:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:17:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2093, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:29:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:29:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3334, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.81.176.90", "classifications": [], "first_seen": { "$date": "2023-06-29T05:32:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:32:19Z" }, "ports": [ 27745 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 1033, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "191.98.191.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T05:33:57Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:51:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12362, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:33:57Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:33:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3326, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.133.168.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T05:37:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:57:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13374, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.226", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:37:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:37:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2066, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:42:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:42:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2116, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:49:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:49:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:50:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:50:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.219.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:50:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:50:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:50:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:50:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2055, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:55:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:55:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2060, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T05:57:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T05:57:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2088, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:02:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:02:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3201, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:03:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:03:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2928, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:11:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:11:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2040, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:11:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:11:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2048, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:14:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:14:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3584, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "98.98.189.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:17:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:17:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5105, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.210.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:18:42Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:18:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2034, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.234.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:19:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:19:02Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3049, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "146.88.241.172", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:19:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:19:48Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 13053, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.229.210.169", "classifications": [], "first_seen": { "$date": "2023-06-29T06:20:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:20:34Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 5079, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.210.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:22:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:22:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2027, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.246.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:24:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:24:50Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3033, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "205.210.31.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:30:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:30:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1992, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:32:42Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:32:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1976, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:46:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:46:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:50:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:50:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1948, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T06:54:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T06:54:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1942, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T07:00:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:00:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3230, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.212.158.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T07:00:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:00:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1964, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T07:10:57Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:10:57Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2904, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "146.88.241.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T07:13:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:46:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8128, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.59.86.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T07:14:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:14:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1934, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.213.74", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T07:29:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T07:29:03Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3852, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "180.128.242.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T07:32:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:07:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5602, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.193.53.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T08:03:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:03:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3270, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.198", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-29T08:05:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:05:51Z" }, "ports": [ 0, 1434, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp" ], "sightings": 1913, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "64.112.74.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T08:10:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:10:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1854, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.191.119", "classifications": [], "first_seen": { "$date": "2023-07-01T02:01:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:02:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 10, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "106.75.233.124", "classifications": [], "first_seen": { "$date": "2023-07-01T02:33:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:38:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 9, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "188.208.141.248", "classifications": [], "first_seen": { "$date": "2023-07-01T03:01:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:01:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "109.132.238.5", "classifications": [], "first_seen": { "$date": "2023-07-01T03:56:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:56:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 14" ], "sightings": 1, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.72.183.25", "classifications": [], "first_seen": { "$date": "2023-07-01T04:09:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:12:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 43, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.27.108.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T08:20:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:20:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1820, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.250.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T08:22:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:22:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1814, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.142.109.64", "classifications": [], "first_seen": { "$date": "2023-07-01T04:20:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:56:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SURICATA TCPv4 invalid checksum", "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 62, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "87.236.176.52", "classifications": [], "first_seen": { "$date": "2023-07-01T04:34:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:35:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 3, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.173.86.225", "classifications": [], "first_seen": { "$date": "2023-07-01T04:35:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:18:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 14", "ET 3CORESec Poor Reputation IP group 3", "ET SCAN Potential SSH Scan" ], "sightings": 52, "tags": [ "alert", "tcp", "ssh", "libssh_0.9.6" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "167.71.210.166", "classifications": [], "first_seen": { "$date": "2023-07-01T04:36:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:20:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET SCAN Potential SSH Scan" ], "sightings": 20, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh", "alert" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "194.87.213.51", "classifications": [], "first_seen": { "$date": "2023-07-01T04:37:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:55:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 9, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "201.248.90.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T04:41:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:49:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "ET COMPROMISED Known Compromised or Hostile Host Traffic group 115", "ET 3CORESec Poor Reputation IP group 26", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 160, "tags": [ "alert", "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "146.88.241.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T08:32:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:34:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10699, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.113.115.211", "classifications": [], "first_seen": { "$date": "2023-07-01T05:17:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:17:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "libssh_0.9.6", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "165.232.180.71", "classifications": [], "first_seen": { "$date": "2023-07-01T05:20:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:25:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound", "ET SCAN Potential SSH Scan" ], "sightings": 44, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "43.153.208.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:33:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:33:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 885, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.87.192.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:36:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:15:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6037, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.84.115.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:37:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:52:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 11309, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.100.92.43", "classifications": [], "first_seen": { "$date": "2023-07-01T05:34:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:34:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "64.112.72.102", "classifications": [ "Misc activity", "Attempted Information Leak", "Attempted Denial of Service" ], "first_seen": { "$date": "2023-06-29T08:37:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:42:55Z" }, "ports": [ 0, 161, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS DNS query amplification attempt" ], "sightings": 10253, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "167.94.138.51", "classifications": [], "first_seen": { "$date": "2023-07-01T05:38:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:38:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "ET INFO SSH-2.0-Go version string Observed in Network Traffic - Inbound" ], "sightings": 2, "tags": [ "alert", "tcp", "ssh", "Go" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.209.102.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:38:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:38:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 876, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.132.109.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T08:38:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:46:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3490, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.210.33", "classifications": [], "first_seen": { "$date": "2023-07-01T06:41:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:41:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [], "sightings": 1, "tags": [ "ssh", "tcp", "ssh", "ssh" ], "rule_count": 0, "classification_count": 0 }, { "ioc": "43.157.65.152", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-06-29T08:38:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:40:01Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 10514, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "77.83.36.43", "classifications": [], "first_seen": { "$date": "2023-07-01T08:05:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:05:30Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "ET CINS Active Threat Intelligence Poor Reputation IP group 76" ], "sightings": 1, "tags": [ "alert", "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "205.210.31.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T08:06:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:22:41Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "ET DROP Dshield Block Listed Source group 1", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "alert", "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "79.137.196.237", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:40:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:52:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9564, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "52.245.211.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:40:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:56:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6073, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.245.100.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:44:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:02:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10339, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.11.94.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:46:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:05:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12673, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.0.25.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:47:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:19:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 25158, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.130.15.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:47:56Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:07:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13728, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "80.82.78.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T08:47:56Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:49:07Z" }, "ports": [ 0, 5060 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(sip) content length mismatch" ], "sightings": 8384, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "43.159.41.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:49:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:05:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10306, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.188.240.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:50:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46284, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.231.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:50:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:06:06Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8646, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.34.237.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:50:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:03:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9464, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.236.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:50:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:05:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6858, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.233.19.92", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-29T08:51:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:51:52Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 12541, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "92.63.196.77", "classifications": [], "first_seen": { "$date": "2023-06-29T08:53:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:53:11Z" }, "ports": [ 3398 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 865, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "186.115.14.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:55:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T08:55:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 860, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.81.214.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T08:56:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:07:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8536, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:00:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:00:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1716, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.182", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:00:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:00:09Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5244, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "188.39.157.178", "classifications": [], "first_seen": { "$date": "2023-06-29T09:02:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:02:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP port 0 traffic", "(stream_tcp) data on SYN packet" ], "sightings": 2565, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "103.13.207.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T09:11:37Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:20:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8141, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.144.150.45", "classifications": [], "first_seen": { "$date": "2023-06-29T09:13:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:13:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid request line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error", "(http_inspect) invalid status line" ], "sightings": 3329, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "192.3.254.159", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T09:14:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:20:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3278, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:17:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:17:03Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5445, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "157.245.53.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:27:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:27:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1619, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.143.234.223", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:33:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:33:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2668, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.15.227.6", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:34:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:34:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4040, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "159.65.2.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:36:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:36:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1620, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.185.184.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:41:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:41:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.16.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T09:55:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T09:55:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1616, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T10:00:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:00:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.37.153.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T10:16:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:28:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9567, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.125.169.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T10:17:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:17:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3498, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.96.100.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T10:20:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:20:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1610, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.24.129.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T10:33:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:52:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11605, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.49.178.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T10:36:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:50:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8505, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.228.109.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T10:38:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T10:38:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 781, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "116.92.213.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T10:59:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:25:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13798, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.226.212.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T11:00:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:16:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8450, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.39.17.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T11:02:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:02:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1542, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.223.114.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T11:03:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:36:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22929, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.137.26.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T11:03:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:15:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6148, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.176.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T11:03:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:39:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22914, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.39.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T11:04:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:20:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9213, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T11:05:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:05:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1570, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T11:15:42Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:15:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2588, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.15.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T11:17:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:17:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1530, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.92.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T11:25:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:40:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8344, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.59.207.176", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T11:26:57Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:26:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3845, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "59.21.95.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T11:28:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:28:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1526, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.69.86.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T11:29:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:38:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8344, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.246.206.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T11:35:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:23:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2856, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.111.249.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T11:44:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T11:44:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1532, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "210.91.73.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T12:00:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:14:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8207, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "2.59.255.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T12:06:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:38:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4178, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.42.32.165", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-06-29T12:07:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:48:44Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4554, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "154.74.133.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T12:38:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:21:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21416, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.190.252.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T12:38:42Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:15:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21448, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.86.49.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T12:41:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:00:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9346, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.69.55.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T12:43:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:20:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21408, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.23.174.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T12:51:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T12:51:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1438, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.186.232.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T13:00:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:00:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2856, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.0.232.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T13:04:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:26:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3808, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.118.223.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T13:10:42Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:10:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1419, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T13:21:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:21:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1408, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.255.245.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T13:41:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:22:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20929, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.68.126.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T13:49:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T13:49:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1398, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.41.98.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T14:08:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:08:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1394, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.180.162.26", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T14:32:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:32:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3485, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.19.57.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T14:37:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T14:37:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1390, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.188.51.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T14:41:26Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:21:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20571, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "88.103.79.196", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T14:43:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:19:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20584, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.193.13.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T14:59:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:19:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8184, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "209.97.183.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:00:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:19:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11590, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.245.111.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:01:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:37:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20212, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.32.82.11", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:01:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:20:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7485, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.97.99", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:01:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:19:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10896, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.217.225.59", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:03:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:19:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9537, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.218.204.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:06:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:20:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20388, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T15:11:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:11:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1366, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.252.204.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:15:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:15:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1360, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.168.147.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:38:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:38:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1319, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.137.65.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T15:57:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:57:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 656, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "102.219.212.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T15:58:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T15:58:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1312, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.133.58.71", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:06:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:24:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9778, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.189.147.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:09:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:09:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1306, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.157.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:10:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:25:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7816, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "66.130.123.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:10:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:10:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 653, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.189.120.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:10:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:29:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.60.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:11:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:22:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7168, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "27.254.235.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:12:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:31:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8456, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.2.158.43", "classifications": [], "first_seen": { "$date": "2023-06-29T16:15:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:15:07Z" }, "ports": [ 8397, 38714 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 1088, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "104.244.195.132", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:18:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:38:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8433, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.22.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:18:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:18:17Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1046, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.183.30.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:21:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:58:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10365, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.176.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T16:24:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:55:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19396, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.197.243.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T16:25:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:25:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1302, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.93.220.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T16:33:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T16:33:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1296, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T16:48:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:02:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2490, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "99.46.3.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T17:10:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:10:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 643, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "113.72.22.23", "classifications": [], "first_seen": { "$date": "2023-06-29T17:19:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:34:25Z" }, "ports": [ 7963, 25751 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 1220, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "147.182.194.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T17:42:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:42:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1307, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "102.220.22.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T17:43:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:01:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7659, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "77.190.94.126", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T17:46:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:22:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 19027, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T17:47:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:47:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1286, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.202.32.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T17:48:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:04:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7642, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.190.88.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T17:48:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:04:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window" ], "sightings": 8276, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.226.201.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T17:49:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:02:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7015, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.128.120.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T17:51:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:03:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6372, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "3.80.133.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T17:52:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:52:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 639, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T17:54:59Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:54:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1278, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.19.215.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T17:55:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:33:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 5507, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.5.155.74", "classifications": [], "first_seen": { "$date": "2023-06-29T17:56:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:56:03Z" }, "ports": [ 27280 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 639, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.210.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T17:56:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:56:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1276, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T17:57:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T17:57:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1312, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:09:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:09:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.5.49.100", "classifications": [], "first_seen": { "$date": "2023-06-29T18:09:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:09:54Z" }, "ports": [ 65353 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 632, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "120.41.211.53", "classifications": [], "first_seen": { "$date": "2023-06-29T18:09:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:09:54Z" }, "ports": [ 23075, 65139 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 638, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.211.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:11:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:11:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.239", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:12:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:12:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:12:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:12:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:14:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:14:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.125.202.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:18:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:18:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:30:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:30:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1260, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:43:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:43:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:44:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:44:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:46:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:46:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T18:52:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T18:52:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1256, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.10.227.62", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T18:56:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:11:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6255, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "42.178.82.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T19:00:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:12:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6246, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "85.254.75.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:01:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:01:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1254, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.131.242.173", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:02:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:02:51Z" }, "ports": [ 177, 0 ], "reporting_nodes": 1, "rules": [ "X11 xdmcp info query", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3762, "tags": [ "udp", "xdmcp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.141.120.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T19:15:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:15:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1245, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:16:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:16:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1240, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.96", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:19:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:19:16Z" }, "ports": [ 22, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 634, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "140.179.239.209", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:20:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:35:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 34511, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.224.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:26:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:26:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17269, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.150.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:26:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:26:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1236, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:32:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:32:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1236, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:33:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:33:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1235, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.142.125.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:34:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:34:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1422, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "102.219.212.82", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T19:37:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:56:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5528, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:38:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:38:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1234, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.155.132.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T19:38:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:01:07Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15519, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "140.179.224.176", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:40:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:40:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 22141, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.153.108.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T19:41:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:54:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6757, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:42:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:42:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1234, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.201", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:42:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:42:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3085, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.210.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:44:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:44:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1234, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.224.166", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:45:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:50:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 32477, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "109.230.4.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:47:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:47:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1229, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:52:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:52:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1404, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.134.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:52:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:52:09Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1839, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "140.179.229.97", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:55:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:55:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15790, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "98.169.165.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:56:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:56:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2442, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.81.61.225", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:58:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:16:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17275, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.120.233", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:58:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:14:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11433, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.81.40", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:58:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:12:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14167, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.75.106", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:59:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:01:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11547, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.183.88", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:59:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:11:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14965, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.33.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T19:59:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T19:59:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13837, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.95.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:00:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:03:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11437, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.112.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:00:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:07:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16801, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.183.163", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:00:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:00:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11140, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.244.64", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:01:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:11:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14682, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.21.147", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:01:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:01:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11118, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.85.66", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:02:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:12:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11590, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.17.184", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:02:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:07:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11469, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.137.1.90", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:02:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:14:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14054, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "193.38.250.131", "classifications": [], "first_seen": { "$date": "2023-06-29T20:03:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:03:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP redirect host", "ICMP Traffic Detected" ], "sightings": 1558, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "52.81.209.128", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:03:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:17:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14270, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.118.150", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:03:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:03:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11031, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.184.70", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:04:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:04:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.109.27", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:04:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:04:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2990, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.101.0", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:05:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:10:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5965, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.86.46", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:06:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:17:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11545, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.5.1", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:06:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:17:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8599, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.238.69", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:07:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:07:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8455, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.106.14", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:08:25Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:08:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2984, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.82.245", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:09:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:09:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2977, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.85.92", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:09:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:09:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8393, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.109.33", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:09:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:14:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11270, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.210.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:10:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:10:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1912, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.128.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:10:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:10:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1204, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.136.110.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:11:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:16:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8628, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.231.234.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:12:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:12:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.222.198.198", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:12:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:12:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8328, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.88.254", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:14:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:16:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11461, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.199.99", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:14:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:14:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2940, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.210.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:15:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:15:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1174, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.136.102.132", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:15:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:15:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8315, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.253.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:21:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:21:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.44.185.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T20:21:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:34:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is missing" ], "sightings": 8142, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.225.251.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T20:21:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:36:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6393, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:28:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:28:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1166, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.80.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:29:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:29:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1162, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:30:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:30:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:35:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:35:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.2.26.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:38:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:38:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:38:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:38:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1154, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.187.206.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:45:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:45:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:46:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:46:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1178, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.199.42.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:53:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:53:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1152, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.36.35.4", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-29T20:54:56Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:54:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 5763, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "60.2.175.118", "classifications": [], "first_seen": { "$date": "2023-06-29T20:55:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:55:28Z" }, "ports": [ 37158 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 575, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.235.24.126", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T20:57:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T20:57:20Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2292, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.150.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:07:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:07:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.214.27.80", "classifications": [], "first_seen": { "$date": "2023-06-29T21:11:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:11:15Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 572, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.211.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:16:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:16:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:21:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:21:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:24:43Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:24:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1172, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.224.13", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:25:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:00:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 25921, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "42.240.129.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:28:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:28:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1422, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:30:25Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:30:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1148, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.229", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:30:25Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:30:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1138, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.91.125.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:35:26Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:35:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1162, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:36:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:36:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1140, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T21:44:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:44:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.161.188.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T21:48:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T21:48:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1136, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:03:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:03:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1792, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.163.185.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:04:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:04:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1132, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:11:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:11:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1288, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.144.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:13:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:13:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1106, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.80.222.163", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:19:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:32:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8133, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.158.2", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:20:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:35:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8106, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.175.230", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:20:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:25:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5465, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.150.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:24:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:24:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1092, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:26:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:26:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.131.222.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:27:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:27:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 2702, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:29:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:29:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1076, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:37:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:37:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1086, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:51:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:51:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1198, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:51:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:51:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T22:52:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T22:52:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1066, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:04:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:04:24Z" }, "ports": [ 0, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 1112, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.203.193.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:06:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:06:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1054, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:19:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:19:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1058, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "39.91.166.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:19:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:52:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15628, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:21:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:21:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1062, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:31:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:31:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1726, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.80.248.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:34:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:34:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1047, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.254.3.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:35:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:49:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4660, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.133.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:35:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:50:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7244, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.158.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:35:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:49:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5703, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.191.116.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:36:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:56:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5685, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.198.26.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:37:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:52:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4650, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.99", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:37:16Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:37:16Z" }, "ports": [ 1900, 0, 5632 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 2550, "tags": [ "udp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "86.77.51.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:38:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:54:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7239, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:38:49Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:38:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1052, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.181.142.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:38:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:59:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5156, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:45:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:45:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1084, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:46:37Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:46:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1040, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:50:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:50:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1032, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:52:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:52:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1034, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-29T23:56:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:56:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1028, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.174.211.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-29T23:56:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-29T23:56:33Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1032, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:02:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:02:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1024, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:05:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:05:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1034, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:07:22Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:07:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1022, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:08:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:08:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1030, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.186.123.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:14:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:14:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1020, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:20:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:20:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1018, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:28:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:28:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1028, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.17.17.32", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T00:28:37Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:37:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2536, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:33:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:33:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1016, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:38:50Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:38:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1012, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:39:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:39:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1012, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.175.130", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T00:40:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:51:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4461, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.116.118.113", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T00:40:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:55:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5415, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.130", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:42:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:42:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1012, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.141.135.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T00:44:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:55:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2921, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.114.96.0", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T00:44:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T00:44:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1004, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:11:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:45:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1804, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:16:44Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:16:44Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 958, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:24:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:24:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 932, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.41.239.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:32:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:32:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 918, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.58.113.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:33:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:33:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1548, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:33:21Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:33:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 908, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:48:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:48:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 894, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.191.70.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:52:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:52:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 892, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:53:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:53:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 892, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T01:55:57Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T01:55:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 890, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.224.151", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T02:05:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:21:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 23149, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.159", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T02:07:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:07:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 880, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T02:09:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:09:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 888, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.167.151.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T02:12:39Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:12:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 876, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T02:13:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:13:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 888, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.127.49.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T02:38:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:38:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 874, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T02:51:54Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:51:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 871, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.224.124", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T02:55:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T02:55:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10176, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:04:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:04:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 790, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.189.91.38", "classifications": [], "first_seen": { "$date": "2023-06-30T03:04:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:04:32Z" }, "ports": [ 60120 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 766, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.216.149.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:05:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:05:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 800, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:06:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:06:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 762, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:09:45Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:09:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 758, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.148.148.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:09:59Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:09:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 758, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:13:59Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:13:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 758, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:15:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:15:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 753, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:17:15Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:17:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 762, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.81.33.157", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:18:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:53:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14970, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.95.149", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:18:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:55:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17531, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.106.235", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:18:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:22:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 8663, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.187.177", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:19:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:51:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16184, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.222.188.146", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:19:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:57:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 18540, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.3.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:19:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:51:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10909, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.61.52", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:20:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:55:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 23188, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.72.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:20:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:43:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17675, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.89.136", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:20:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:57:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15142, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.83.253", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:22:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:56:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13652, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.136.156", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:22:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:51:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20591, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.44.79", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:23:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:55:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17087, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.244.56", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:23:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:53:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 18778, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.70.210", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:24:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:42:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14946, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.249.219", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:24:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:40:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13692, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.194.174", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:24:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:46:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17922, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.240.32.181", "classifications": [], "first_seen": { "$date": "2023-06-30T03:24:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:24:48Z" }, "ports": [ 64938, 14174, 31478, 54538, 15219, 22596, 37578 ], "reporting_nodes": 2, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 599, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "216.218.206.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:24:48Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:24:48Z" }, "ports": [ 80, 0 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 375, "tags": [ "tcp", "http", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.216.149.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:24:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:24:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 730, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.80.224.236", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:25:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:52:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20451, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.97.129", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:25:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:53:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16819, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "54.223.104.30", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:25:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:35:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15653, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.5.171.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T03:25:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:43:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3141, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.170.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T03:26:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:41:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4559, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "140.179.179.100", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:26:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:44:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16666, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.57.209", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:26:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:32:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13548, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "157.245.88.255", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T03:27:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:44:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4880, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "71.137.2.32", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:27:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:50:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14978, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.105.106", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:27:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:55:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10577, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.248.141.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T03:27:40Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:40:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3498, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "71.136.76.7", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:28:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:49:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10764, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.78.79", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:28:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:49:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 17338, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "140.179.85.242", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:29:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:56:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 16740, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "43.156.62.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T03:29:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:10:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8576, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.239.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T03:29:57Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:43:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3479, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:30:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:30:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 718, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.80.140.29", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:30:23Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:39:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12282, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.105.83", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:33:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:55:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 19898, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.206.2", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:34:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:50:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13813, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.211.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:34:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:34:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.228.112.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:35:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:35:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 714, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.81.109.171", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:36:05Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:49:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12466, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "71.136.80.30", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:37:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:40:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13498, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.211.55", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:44:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:44:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 694, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.243.156.40", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:49:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:49:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1705, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:50:35Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:50:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 682, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.16.118", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:53:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:53:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 682, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:56:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:56:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 682, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T03:58:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T03:58:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 678, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.251.88.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T04:01:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:20:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4377, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.184.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T04:02:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:02:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 339, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.226.100.28", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T04:03:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:20:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4709, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.225.175.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T04:04:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:20:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4712, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:05:13Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:05:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 682, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.192.81.160", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T04:06:36Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:32:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4349, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.88.110.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T04:06:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:21:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4707, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.227.178.135", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-30T04:10:10Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:10:10Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request tcp" ], "sightings": 707, "tags": [ "icmp", "tcp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "124.129.198.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:12:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:12:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 673, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:17:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:17:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 708, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:18:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:18:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 682, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.97", "classifications": [ "Misc activity", "Executable code was detected", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-06-30T04:18:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:18:06Z" }, "ports": [ 0, 22, 1900, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "INDICATOR-SCAN UPnP service discover attempt", "APP-DETECT PCAnywhere server response" ], "sightings": 689, "tags": [ "icmp", "tcp", "ssh", "udp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "35.203.211.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:19:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:19:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 670, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:22:58Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:22:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 672, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.229", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:25:34Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:25:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 668, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.165.239", "classifications": [], "first_seen": { "$date": "2023-06-30T04:29:29Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:29:29Z" }, "ports": [ 65433, 7293, 26935 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 342, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "91.238.105.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:45:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:10:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1264, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:50:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:50:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:50:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:50:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:53:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:53:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 662, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.16.63.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T04:54:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:54:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1640, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "149.30.167.177", "classifications": [], "first_seen": { "$date": "2023-06-30T04:58:02Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T04:58:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 694, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "205.210.31.85", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-06-30T05:00:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:00:17Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 662, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "190.202.130.61", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T05:04:18Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:25:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4200, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.191", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:06:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:06:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 738, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.165.206", "classifications": [], "first_seen": { "$date": "2023-06-30T05:08:33Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:08:33Z" }, "ports": [ 9433 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 327, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.150.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:12:26Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:12:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 656, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:16:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:16:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:24:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:24:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 736, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.200.91.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:24:53Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:24:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 640, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.130.91.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T05:30:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:31:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 640, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:31:19Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:31:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 644, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:34:41Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:34:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 640, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:37:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:04:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3884, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:39:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:39:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 638, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.81.77.186", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:39:07Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:44:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 14498, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "101.32.115.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T05:40:49Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:55:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3429, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "71.136.75.138", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:40:49Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:54:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11222, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.150.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:42:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:42:38Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 642, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.244.77.92", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-30T05:42:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:42:38Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 317, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "54.223.242.154", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:42:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:52:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 15070, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.81.108.238", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:43:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:57:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 13893, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.243.140.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:44:52Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:44:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 630, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.230.62.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:46:17Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:46:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 626, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.81.55.38", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:48:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:47:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12607, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "52.80.107.54", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:48:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:55:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 12738, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.211.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:52:08Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:52:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 618, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.179.179.32", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:53:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:53:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10547, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:58:38Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:58:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 614, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.153.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T05:59:27Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T05:59:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 610, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:01:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:01:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:02:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:02:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:02:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:02:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.250.2.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:05:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:05:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Time-To-Live Exceeded in Transit" ], "sightings": 606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.130.19", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:07:20Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:07:20Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 909, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.146.13", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:07:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:07:31Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 909, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "165.154.128.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:08:01Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:08:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1212, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.232", "classifications": [ "Executable code was detected", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:10:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:10:09Z" }, "ports": [ 22, 161, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 321, "tags": [ "tcp", "ssh", "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "205.210.31.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:14:31Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:14:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.17.44.124", "classifications": [], "first_seen": { "$date": "2023-06-30T06:15:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:15:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 996, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "35.203.211.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:15:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:15:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 606, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:19:09Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:19:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 642, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.100", "classifications": [ "Attempted Information Leak", "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-06-30T06:22:49Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:22:49Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 989, "tags": [ "udp", "icmp" ], "rule_count": 6, "classification_count": 3 }, { "ioc": "118.46.108.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T06:25:37Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:26:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 604, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.97.126.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T06:25:42Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:25:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 604, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.123.78.129", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-30T06:27:49Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:27:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 3040, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "69.164.202.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:28:30Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:28:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 938, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:33:28Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:33:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 610, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.81.59.169", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:38:12Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:42:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 11227, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.211.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:38:14Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:38:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 608, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:41:03Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:41:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 596, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.215", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-06-30T06:53:47Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:53:47Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 588, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.232.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:53:55Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:53:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 582, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:55:00Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:55:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.154.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T06:58:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T06:58:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 578, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:02:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:02:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 578, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:02:46Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:02:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 598, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:07:11Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:16:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2722, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.75.74.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:08:32Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:08:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 641, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:13:04Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:13:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:13:24Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:13:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 576, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.119.81.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T07:16:06Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:31:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2583, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.154.53.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:34:51Z" }, "ja3": [], "last_seen": { "$date": "2024-06-30T07:34:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1435, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "162.243.142.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:47:20Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:47:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 572, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.50.99.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:53:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:53:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 568, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.80.142.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T07:58:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T07:58:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 566, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.40.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T08:01:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:20:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4051, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.230.152.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T08:04:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:21:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3553, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.212", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T08:08:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:08:48Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 837, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "125.26.179.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T08:09:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:15:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1357, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.233.19.94", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-30T08:13:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:38:42Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 3119, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "39.153.215.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T08:30:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:30:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 512, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.238.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T08:33:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:33:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 502, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T08:39:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:39:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 496, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "155.133.23.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T08:43:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:43:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 534, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T08:49:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:49:48Z" }, "ports": [ 0, 5632 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 504, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.199.96.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T08:52:52Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T08:52:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 510, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "148.66.12.66", "classifications": [], "first_seen": { "$date": "2023-06-30T08:53:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:13:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 866, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.216.150.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T09:14:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:14:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 492, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.139.80", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T09:18:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:18:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 246, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.65.126.16", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T09:21:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:43:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4048, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T09:27:49Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:27:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 492, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.118.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T09:29:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T09:48:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 968, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.113.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T09:59:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:10:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2622, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.190.174.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T10:03:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:03:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 488, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.216.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T10:04:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:04:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 468, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T10:05:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:05:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 468, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.102.54.8", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-06-30T10:13:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:13:08Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2444, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.94.138.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T10:35:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:35:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 434, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.144.142.138", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-30T10:35:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T10:35:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 2181, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.216.149.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T10:54:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:10:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 420, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:04:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:04:22Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 561, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "106.75.144.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:08:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:15:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:08:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:08:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:12:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:12:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.197.175.67", "classifications": [], "first_seen": { "$date": "2023-06-30T11:21:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:21:27Z" }, "ports": [ 2223 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 374, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "80.52.167.130", "classifications": [], "first_seen": { "$date": "2023-06-30T11:32:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:32:42Z" }, "ports": [ 47910, 30188 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 381, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "185.97.119.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:36:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:36:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 360, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "94.198.197.67", "classifications": [], "first_seen": { "$date": "2023-06-30T11:43:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:52:52Z" }, "ports": [ 8391, 7821 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP has no SYN, ACK, or RST" ], "sightings": 386, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.150.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:47:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:47:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 364, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.183.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:55:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:55:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 356, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.148.122.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:55:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:45:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 720, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.125.184.57", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T11:55:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:55:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 355, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T11:55:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T11:55:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 374, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.87.184.120", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T11:57:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:13:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1936, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.72.194.207", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T11:58:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:22:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2094, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.18.212.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T11:59:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:14:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1994, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.219.241.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T12:02:34Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:11:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1939, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "221.162.20.252", "classifications": [], "first_seen": { "$date": "2023-06-30T12:05:51Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:05:51Z" }, "ports": [ 62196 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 177, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.210.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T12:14:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:14:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 346, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T12:16:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:16:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 354, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.114.233.6", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T12:23:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:33:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 688, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.135", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T12:33:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:33:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 356, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.231.46.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T12:38:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:53:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1351, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T12:40:02Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:40:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 344, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.142.219.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T12:41:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:41:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 342, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.90.209.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T12:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:07:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2352, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "114.44.132.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T12:48:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:08:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2184, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.170.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T12:48:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:03:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1680, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "50.223.37.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T12:52:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:05:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 672, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "18.222.157.216", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T12:55:12Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T12:55:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 336, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.50.16.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T13:16:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:51:58Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 5020, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.6.9.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T13:20:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:20:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 336, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.226.214.79", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T13:32:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:55:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2447, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.30.149.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T13:36:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:16:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4697, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.236.28.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T13:40:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:00:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2432, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.89.234.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T13:44:51Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:44:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 326, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.98.59.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T13:53:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:25:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 488, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.131.52.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T13:53:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:53:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 648, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.233.127.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T13:57:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T13:57:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 644, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.251.23.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T14:01:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 322, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T14:10:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:10:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 294, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.158.123.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T14:14:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:14:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 282, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.213.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T14:28:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:28:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 268, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T14:33:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:33:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 268, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.61.184.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T14:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:43:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 454, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.254.74.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T14:43:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T14:43:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 266, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.126.11.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T14:48:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:40:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 442, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.148.153.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T14:53:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:13:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1692, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "223.171.32.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:05:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:30:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 2476, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "112.53.143.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T15:06:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:06:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 650, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "209.250.240.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T15:07:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:07:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 260, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.236.23.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:07:51Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:24:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1775, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "79.59.251.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:48:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3531, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.119.91.228", "classifications": [], "first_seen": { "$date": "2023-06-30T15:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:08:58Z" }, "ports": [ 27018 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 650, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.135.163.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:08:22Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:22:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1781, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.240.27.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:08:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:25:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1638, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.251.20.149", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-30T15:10:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:10:15Z" }, "ports": [ 0, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-SNMP request udp" ], "sightings": 287, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "103.162.20.168", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:10:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:24:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1439, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.1.156.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:10:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:31:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1349, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.214.53.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T15:18:47Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:46:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 1154, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "90.168.201.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:24:15Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:45:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1776, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.170.254.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T15:25:53Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:25:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 237, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.126.204.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:28:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:42:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1461, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.102.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T15:28:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:59:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1224, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "95.102.18.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T15:32:52Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:32:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 226, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.61.185.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T15:44:32Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:24:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 436, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.152.52.186", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-06-30T15:46:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T15:47:16Z" }, "ports": [ 0, 1935, 162, 49156, 1900, 53, 161, 5353, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) TCP portscan", "PROTOCOL-SNMP trap udp", "(port_scan) UDP portscan", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "(sip) content length mismatch" ], "sightings": 16071, "tags": [ "icmp", "tcp", "udp", "snmptrap", "snmp" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "35.203.211.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:07:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:07:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 204, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.67.65.50", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 1000, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "195.154.107.109", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 998, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.112.124.39", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.33.245.128", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.11.105.192", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "83.138.55.102", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.185.199.65", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "102.130.48.137", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.244.30.57", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.179.44.80", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 995, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "92.118.190.55", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 994, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "95.143.196.114", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 985, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.93.69.18", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 989, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "213.170.133.158", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 985, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.33.14.120", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 984, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "172.83.159.59", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 980, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "8.218.46.173", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 975, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "8.209.214.16", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 975, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.185.218.184", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 972, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.151.111.162", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 970, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "185.47.128.182", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 965, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "51.161.204.73", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:08:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:08:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 965, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "14.136.77.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:26:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:26:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 190, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.82.189.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:36:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:36:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 190, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.203.224.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:40:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:56:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1316, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.97.192.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:45:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T16:45:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 188, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.226.210.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:50:41Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:10:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.97.182.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:51:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:09:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.217.159.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:54:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:14:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1205, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.75.159.201", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:54:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:10:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1023, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "211.110.140.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:55:08Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:39:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2720, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.175.179.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:09:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 932, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.35.18.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T16:57:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:26:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 262, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.90.166.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:58:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:16:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1475, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "37.152.182.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T16:59:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:14:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 923, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.74.90.102", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-06-30T17:01:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:02:44Z" }, "ports": [ 0, 69 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP NULL command attempt" ], "sightings": 237, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "143.198.46.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T17:04:28Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:04:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 186, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.192.54.176", "classifications": [], "first_seen": { "$date": "2023-06-30T17:12:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:12:24Z" }, "ports": [ 3788 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 91, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "222.84.118.67", "classifications": [], "first_seen": { "$date": "2023-06-30T17:13:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:13:27Z" }, "ports": [ 3741 ], "reporting_nodes": 1, "rules": [ "(tcp) XMAS attack detected", "(tcp) TCP SYN with RST", "(tcp) TCP SYN with FIN" ], "sightings": 273, "tags": [ "tcp" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "162.216.149.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T17:26:57Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:26:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 184, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T17:27:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:27:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 178, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.82.26.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T17:48:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:48:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 178, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.182", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T17:54:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T17:54:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 196, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:08:39Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:08:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 176, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.39.118.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:10:07Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:10:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 176, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.213", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-30T18:11:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:24:16Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 264, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.203.210.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:15:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:15:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 168, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:25:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:25:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 164, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.133.191.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:29:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:29:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 320, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.44.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:33:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:33:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.85.213.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:33:36Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:33:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "41.214.134.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:37:23Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:37:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 158, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.46.164.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T18:37:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:14:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 1925, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.144.87.192", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T18:38:38Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:54:00Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 935, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:39:02Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:39:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:46:37Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:46:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 150, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T18:56:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T18:56:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 148, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:02:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:02:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 154, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.48.201.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:03:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:03:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 154, "tags": [ "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "58.23.109.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:06:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:06:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 146, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:08:33Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:08:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 182, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:09:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:09:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 146, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.129.253.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:15:50Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:15:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 146, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:20:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:20:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 142, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:37:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:37:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:37:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:37:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 144, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:39:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:39:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 156, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:42:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:42:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.253.88.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:45:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:45:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 136, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.52.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T19:51:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:08:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 796, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.161.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T19:52:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:37:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 403, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.152.113.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T19:52:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:09:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 919, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.37.238.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T19:53:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:07:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 550, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:56:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:56:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T19:57:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T19:57:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 124, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:01:31Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:01:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 122, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.106.104.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T20:18:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:34:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 679, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.190.98.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T20:19:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:37:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 610, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.93.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T20:19:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:43:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 604, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.215.235.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T20:21:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:38:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 505, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.152.52.139", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-06-30T20:21:24Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:22:58Z" }, "ports": [ 0, 10024, 49, 161, 631, 1900, 162, 5060, 53, 22225 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) TCP portscan", "(port_scan) UDP portscan", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-SNMP trap udp", "INDICATOR-SCAN UPnP service discover attempt", "(sip) content length mismatch", "PROTOCOL-DNS named version attempt" ], "sightings": 8537, "tags": [ "icmp", "tcp", "udp", "snmp", "snmptrap" ], "rule_count": 10, "classification_count": 3 }, { "ioc": "185.200.217.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T20:21:25Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:40:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 750, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:22:58Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:22:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 106, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:24:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:24:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 104, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.70.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T20:25:10Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:33:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 353, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.43.89.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T20:25:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:56:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 679, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.236.176.67", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:25:56Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:25:56Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 208, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.119.85.67", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T20:40:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:55:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 460, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.132.109.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:47:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:25:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 168, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.116", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:47:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:47:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.245.107.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:48:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:48:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:52:54Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:52:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 98, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:57:18Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:57:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 90, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T20:59:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T20:59:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 90, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.41.226.47", "classifications": [], "first_seen": { "$date": "2023-06-30T21:02:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:02:09Z" }, "ports": [ 30120 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 88, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.211.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:04:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:04:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 86, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.223", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:09:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:09:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:09:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:10:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "207.180.246.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:02:59Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 248, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:16:08Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:16:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 78, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:22:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:27:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 168, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.70.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T21:22:29Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:38:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 582, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.7.199.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:29:48Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:29:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 74, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "98.51.191.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:31:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:31:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 148, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:38:01Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:38:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 82, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.38.36.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:53:03Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:53:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T21:56:04Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T21:56:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.16.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T22:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:22:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 403, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "195.58.6.45", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T22:03:43Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:19:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 372, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.51.199", "classifications": [], "first_seen": { "$date": "2023-06-30T22:04:16Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:04:16Z" }, "ports": [ 5437 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 31, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "43.154.89.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T22:05:13Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:23:41Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 487, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.191", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T22:05:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:05:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 66, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.211.36.111", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T22:06:27Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:23:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 217, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T22:10:44Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:10:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.12.115.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T22:11:09Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:29:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 341, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.245.125.56", "classifications": [], "first_seen": { "$date": "2023-06-30T22:34:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:34:06Z" }, "ports": [ 20728 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 31, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.149.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T22:38:46Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:38:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.223", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T22:38:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:40:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 98, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.189.178.220", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-06-30T22:44:19Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:44:19Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 31, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T22:59:42Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T22:59:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.158.109.144", "classifications": [], "first_seen": { "$date": "2023-06-30T23:00:45Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:00:45Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 31, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.149.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:02:17Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:02:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 70, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:15:05Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:15:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:21:40Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:21:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:27:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:27:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.72", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:27:06Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:27:06Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 156, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:35:14Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:35:14Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 90, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.235.24.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:36:30Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:36:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:36:35Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:36:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.98.191.213", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-06-30T23:37:11Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:55:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 318, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:49:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:15:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 94, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-06-30T23:58:26Z" }, "ja3": [], "last_seen": { "$date": "2023-06-30T23:58:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.239.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:00:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:00:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:00:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:00:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:03:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:03:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.253.61.105", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:09:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:58:44Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 122, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "201.249.57.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T00:09:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:20:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 196, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.183", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:12:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:12:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.47.59.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T00:12:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:46:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 840, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "31.220.55.219", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T00:13:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:28:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 336, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.99.252.222", "classifications": [], "first_seen": { "$date": "2023-07-01T00:23:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:23:21Z" }, "ports": [ 55080 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 28, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "79.52.195.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T00:26:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 224, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.203", "classifications": [ "Misc activity", "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T00:26:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:26:50Z" }, "ports": [ 1434, 0, 22 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 88, "tags": [ "udp", "icmp", "tcp", "ssh" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "182.31.62.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T00:36:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:37:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:40:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:40:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 64, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.242.28.147", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:41:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:41:15Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.150.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:41:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:41:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:45:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:45:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.23.203.61", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:52:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:11:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 204, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.60.9.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:53:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:10:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 82, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T00:55:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T00:55:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 92, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:01:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:01:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:06:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:06:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 76, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.236.176.14", "classifications": [], "first_seen": { "$date": "2023-07-01T01:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:15:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "31.220.57.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:24:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:40:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 339, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.209.41.36", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:24:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:06:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 774, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.241.126.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:25:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:39:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 371, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:25:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:35:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 106, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.236.20.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:25:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:42:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 313, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.41.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:25:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:41:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 313, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.253.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:26:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:44:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 391, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.181.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:28:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:43:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 338, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.57.189.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:28:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:43:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 312, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:28:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:28:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.84.22.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:28:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:47:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 286, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.31.162.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:29:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:44:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 390, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.182.17.12", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:31:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:52:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 234, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.143.25.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:32:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:32:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:36:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:36:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:36:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:36:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:37:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:37:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.79", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-01T01:45:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:45:41Z" }, "ports": [ 0, 53 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt" ], "sightings": 73, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.203.211.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:46:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:46:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.126.202.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:54:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:54:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.167.223.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:56:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:13:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 268, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:57:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:57:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T01:57:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T01:57:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.56.29.117", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T01:57:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:14:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 317, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.185.137.78", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:00:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:16:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 242, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.190", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:11:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:11:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 76, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:12:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:12:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.165.219", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-01T02:16:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:36:04Z" }, "ports": [ 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 47, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.104.70.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:16:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:24:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 72, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:18:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:18:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:24:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:24:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.219.231.175", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:29:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:44:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 207, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.221.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:31:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:31:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:33:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:33:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.209.191.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:36:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:49:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 248, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.133.86.38", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:37:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:52:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 265, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.61.245.13", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:38:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:26:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 635, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:38:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:38:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.92.192.194", "classifications": [ "Misc activity", "Attempted Denial of Service", "Detection of a Network Scan", "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-01T02:38:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:31:07Z" }, "ports": [ 0, 53, 1900, 161 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS DNS query amplification attempt", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-DNS named version attempt" ], "sightings": 311, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 4 }, { "ioc": "162.216.149.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:38:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:38:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:38:30Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.21.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:39:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:53:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 309, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.244.164.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:39:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:21:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 391, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.226.103.75", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:40:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:52:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 242, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.121.205.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T02:43:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:18:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 256, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:44:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:44:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.22.124.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:44:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:44:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T02:51:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T02:51:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 66, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.198.142.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:06:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:06:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:06:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:06:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.212.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:08:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:08:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.36.207.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T03:08:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:24:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 252, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.225.53.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T03:10:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:21:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 210, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.30.129.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T03:10:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:23:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 229, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.159.146.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T03:10:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:23:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 273, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.142.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:13:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:03:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 88, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.40.156.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:15:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:15:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.129.14.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:18:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:18:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "209.74.104.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:20:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:20:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:36:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:36:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:36:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:36:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.95.147.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:51:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:03:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 100, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T03:53:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T03:53:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T04:04:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:04:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T04:04:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:04:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.65.171.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T04:10:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:10:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T04:11:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:11:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 58, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.227.228.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T04:25:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:01:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 456, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "191.233.25.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T04:31:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:21:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session" ], "sightings": 551, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T04:32:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:32:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.66.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T04:44:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:02:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 247, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "106.246.224.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T04:48:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:05:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 247, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T04:51:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:51:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T04:53:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:53:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T04:53:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T04:53:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.52.58.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:00:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:06:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 76, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "141.95.40.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:04:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:04:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 102, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:12:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:12:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.146", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:18:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 50, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.197", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:19:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:19:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:20:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:20:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:24:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:24:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:27:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:27:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.208.26.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:29:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:29:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 38, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:32:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:32:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:32:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:32:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:45:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:45:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:47:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:47:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.245.97.115", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:48:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:48:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.77.215.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:49:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:49:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:51:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:51:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.139.19.123", "classifications": [], "first_seen": { "$date": "2023-07-01T05:51:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:51:09Z" }, "ports": [ 22380 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 18, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.149.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:54:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:54:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.170.38.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:55:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:55:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:56:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:56:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:58:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:58:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T05:58:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:58:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.86.82.114", "classifications": [], "first_seen": { "$date": "2023-07-01T05:59:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T05:59:23Z" }, "ports": [ 63283, 42582, 53381, 47755 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 30, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.211.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:00:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:00:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.213.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:01:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:01:16Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.204.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:11:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:11:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.90.160.131", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:12:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:20:00Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 120, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:14:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:14:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:19:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:19:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.216.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:25:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:25:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.215.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:26:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:26:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.0.15.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T06:26:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:12:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 409, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.245.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T06:26:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:06:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 412, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.193.15", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:33:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:33:27Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.156.93.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T06:33:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:49:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 112, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.95.146.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T06:37:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:54:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 140, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.252.4.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:39:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:39:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:41:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:41:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.192.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:42:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:42:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:42:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:42:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "180.244.128.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:46:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:46:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.198.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:47:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:47:00Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 42, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "58.8.226.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:51:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:51:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.44.238.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:54:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:54:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 58, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.21.107.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:58:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:58:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.97.210.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T06:59:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T06:59:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.138.5.151", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T07:01:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:15:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 143, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "171.248.171.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T07:01:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:22:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 169, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.29.17.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T07:07:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:07:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.112", "classifications": [], "first_seen": { "$date": "2023-07-01T07:10:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:10:36Z" }, "ports": [ 55330, 61919 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 18, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "59.2.52.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T07:14:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:14:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T07:15:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:15:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.180.97.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T07:21:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:21:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.251.102.93", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T07:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:34:24Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 91, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.251.102.91", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T07:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:34:24Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 91, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.251.102.92", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T07:28:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:34:24Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 91, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T07:35:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:35:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.238.184.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T07:47:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:47:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.42.33.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T07:50:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T07:50:43Z" }, "ports": [ 12684, 0 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP PDU missing ack for established session", "(tcp) TCP urgent pointer exceeds payload length or no payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "tcp", "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "198.235.24.241", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-01T08:26:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:26:09Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 39, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T08:26:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:26:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T08:32:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:32:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.130.196.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T08:38:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:38:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.116.53.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T08:57:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:57:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T08:59:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T08:59:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.99.10.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T09:13:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:32:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 139, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T09:14:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:14:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.209.102.145", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T09:26:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:26:10Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "152.32.253.58", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T09:26:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:26:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) reset outside window", "(ssh) payload size incorrect for the given payload" ], "sightings": 46, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "185.200.118.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T09:28:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:32:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.25.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T09:40:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:57:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 135, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.103.67.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T09:44:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:09:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 320, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "207.249.123.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T09:45:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:04:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 144, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "120.55.99.107", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T09:48:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T09:48:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 55, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "154.84.19.74", "classifications": [], "first_seen": { "$date": "2023-07-01T10:03:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:03:44Z" }, "ports": [ 3382 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 33, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "200.25.2.104", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T10:06:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:06:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 121, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.33.108.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T10:13:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:13:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.226", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T10:16:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:16:22Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.149.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T10:16:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:16:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T10:21:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:21:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.228.15.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T10:37:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:37:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.229.101.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T10:37:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:38:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.209.252.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T10:41:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:41:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.237.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T10:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:43:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.134.17", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-01T10:44:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:44:29Z" }, "ports": [ 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp" ], "sightings": 9, "tags": [ "tcp", "snmptrap" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.42.157.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T10:55:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T10:55:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.163.190.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T11:08:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:08:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.142.227.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T11:20:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:20:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.163.156.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T11:32:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:51:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 54, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.115.87.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T11:39:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:39:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "66.36.234.90", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-07-01T11:52:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:52:17Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 84, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.149.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T11:53:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:53:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.66.57.158", "classifications": [], "first_seen": { "$date": "2023-07-01T11:55:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:55:47Z" }, "ports": [ 42629 ], "reporting_nodes": 1, "rules": [ "(tcp) truncated TCP options", "(stream_tcp) data on SYN packet" ], "sightings": 18, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "60.249.117.161", "classifications": [], "first_seen": { "$date": "2023-07-01T11:56:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:56:49Z" }, "ports": [ 36284 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 9, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.88.194.239", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T11:56:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T11:58:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.250.57.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T12:00:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:00:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.72.104.50", "classifications": [ "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-01T12:04:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:04:40Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 261, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "36.74.45.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T12:16:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:16:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "45.83.66.130", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-01T12:31:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:31:23Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "47.254.129.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T12:40:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:40:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.5", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T12:42:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:42:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "136.243.0.174", "classifications": [], "first_seen": { "$date": "2023-07-01T12:44:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:44:36Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 9, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.222.199.235", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T12:47:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:00:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.155.45.55", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T12:49:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:07:59Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 140, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.18.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T12:52:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T12:52:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.101.180.167", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T13:02:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:22:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 99, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.15.159.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T13:05:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:19:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 188, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.200.169", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T13:05:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:22:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 140, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "101.36.177.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T13:06:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:27:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 81, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "163.172.34.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T13:07:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:07:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "187.251.135.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T13:07:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:13:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T13:40:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:40:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.1.30", "classifications": [], "first_seen": { "$date": "2023-07-01T13:51:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T13:51:20Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 9, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.38.240.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T14:05:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:05:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.28.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T14:12:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:12:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.187.178.94", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-01T14:20:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:20:51Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.134.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T14:22:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:22:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "233.210.70.7", "classifications": [], "first_seen": { "$date": "2023-07-01T14:25:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:25:36Z" }, "ports": [ 29975, 11188 ], "reporting_nodes": 1, "rules": [ "(ipv4) IPv4 packet from multicast source address" ], "sightings": 11, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "94.228.169.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T14:26:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:26:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 26, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.254.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T14:57:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T14:57:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.242.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T15:03:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:03:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.145.161.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T15:03:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:03:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.214.92.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T15:24:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:38:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 81, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.231.220.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T15:26:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:26:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.74.91.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T15:32:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:32:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.251.27.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T15:43:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:43:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.241.240.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T15:44:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:44:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 45, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "192.161.179.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T15:52:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T15:52:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.97.165.61", "classifications": [], "first_seen": { "$date": "2023-07-01T15:52:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:20:12Z" }, "ports": [ 14263, 9642, 12583 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 23, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "119.206.59.5", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T16:01:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:02:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.90.224.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T16:01:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:01:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "217.195.197.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T16:07:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:07:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T16:32:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:14:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 64, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "203.178.148.19", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T16:43:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:26:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 3970, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "84.201.158.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T16:45:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:02:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 315, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.160.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T16:45:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:01:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 126, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.6.53", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T16:47:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:01:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 108, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.145.254", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T16:48:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:02:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 108, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.83.66.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T16:52:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:52:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.109.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T16:57:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T16:57:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.170.246.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T17:10:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:10:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "212.145.210.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T17:16:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:21:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "164.152.252.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T17:18:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:46:50Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 205, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.45.45.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T17:19:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:39:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 99, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T17:23:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:23:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.250.149.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T17:26:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:55:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.245.113.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T17:28:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:28:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T17:30:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:31:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T17:43:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:43:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T17:48:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:48:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T17:49:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:50:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.139.189.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T17:56:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T17:56:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T18:03:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:03:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 56, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T18:05:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:05:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.233.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T18:09:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:09:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.219.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T18:09:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:18:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.243.12.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T18:18:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:18:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.159.42", "classifications": [], "first_seen": { "$date": "2023-07-01T18:19:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:19:36Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 9, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.211.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T18:25:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:26:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.61.107.27", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T18:33:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:33:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T18:37:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:37:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.245.61.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T18:45:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:04:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 108, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.90.220.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T18:46:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:02:26Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 166, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.187.177.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T18:48:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:48:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.88.232.211", "classifications": [], "first_seen": { "$date": "2023-07-01T18:52:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T18:52:02Z" }, "ports": [ 2081 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP PDU missing ack for established session", "(tcp) TCP urgent pointer exceeds payload length or no payload" ], "sightings": 18, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "203.205.37.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T19:02:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:21:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 72, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "186.235.7.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T19:03:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:03:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.169.153", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T19:05:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:22:34Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 69, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "133.175.161.191", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T19:12:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:14:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 198, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T19:14:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:15:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T19:21:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:21:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.113.98.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T19:28:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:29:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.163.242.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T19:34:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:50:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T19:41:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:42:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.39.196.221", "classifications": [], "first_seen": { "$date": "2023-07-01T19:42:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:21:17Z" }, "ports": [ 7762 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 135, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "197.44.195.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T19:53:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T19:53:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "197.159.133.194", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T19:59:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:17:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 108, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T20:03:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:03:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.52.251.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T20:03:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:28:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 270, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T20:08:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:08:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T20:14:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:15:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.84", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T20:18:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:18:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T20:36:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:37:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.99.222.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T20:41:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:55:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 81, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.133.11.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T20:44:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:44:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 72, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "37.39.183.238", "classifications": [], "first_seen": { "$date": "2023-07-01T20:47:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:47:47Z" }, "ports": [ 7762 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 45, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "221.204.171.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T20:48:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:48:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.251.23.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T20:56:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T20:56:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.168.144", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T21:15:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:35:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "94.229.79.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T21:16:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:32:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 135, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.236.250.90", "classifications": [], "first_seen": { "$date": "2023-07-01T21:22:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:22:58Z" }, "ports": [ 7762 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 45, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "47.245.101.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T21:24:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:24:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.195", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T21:33:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:33:54Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.203.211.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T21:34:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:34:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.209.218.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T21:36:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:36:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "58.214.161.242", "classifications": [], "first_seen": { "$date": "2023-07-01T21:54:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:54:35Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 9, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.211.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T21:57:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T21:57:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T21:59:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:00:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 36, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "62.112.8.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:04:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:04:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 108, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.253.62.238", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:05:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:05:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.42.57.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:17:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:17:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.246", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:19:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:19:50Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 27, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.88.90.119", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:20:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:20:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.147.250.222", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-01T22:33:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:33:03Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 9, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.233.19.68", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:42:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:07:44Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 155, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.150.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:48:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:48:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 22, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "82.66.3.241", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T22:48:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:48:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:56:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:57:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T22:57:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T22:57:18Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.242.243.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:01:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:09:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.245.132.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:06:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:20:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.100.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:07:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:19:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 77, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.195.43.184", "classifications": [], "first_seen": { "$date": "2023-07-01T23:07:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:07:51Z" }, "ports": [ 8229 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 7, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "13.124.132.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:14:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:53:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 189, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "161.35.236.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:15:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:34:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 93, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.114.51.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:16:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:29:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "102.220.23.51", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:17:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:38:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 84, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.71.96.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:18:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:24:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 21, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:18:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:18:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.65.253.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:18:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:33:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.186.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:19:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:37:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 64, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "151.106.112.102", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:20:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:34:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.227.152.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:21:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:30:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data", "(stream_tcp) TCP timestamp is missing" ], "sightings": 196, "tags": [ "tcp", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "64.227.41.96", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:24:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:24:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.227.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-01T23:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:40:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 61, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.213.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:29:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:29:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.234", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:31:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:31:18Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.141.87.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:37:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:04:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "98.98.189.131", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:42:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:42:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.93.16.237", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:44:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:44:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:50:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:50:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.161.41.45", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-01T23:55:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-01T23:55:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "147.139.212.190", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:00:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:00:00Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.149.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:03:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:03:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.227.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:03:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:03:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.38.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:03:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:03:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.219.240.49", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T00:03:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:17:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "41.223.99.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T00:07:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:21:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.90.0.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T00:10:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:21:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.86", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:11:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:12:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.67", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:14:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:14:58Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.219.251.190", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-02T00:16:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:33:50Z" }, "ports": [ 161, 162 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp", "PROTOCOL-SNMP trap tcp" ], "sightings": 44, "tags": [ "tcp", "snmp", "snmptrap" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.109.147.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:17:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:17:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.183", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:19:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:41:47Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 108, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.235.24.94", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:22:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:22:45Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "147.139.116.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:26:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:26:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:31:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:31:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:31:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:31:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.248.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T00:38:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:38:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 151, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.245.35.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T00:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:43:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 83, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.123", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-07-02T00:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:39:27Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 82, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "146.88.241.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:39:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 90, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.153", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:39:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.143", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-07-02T00:39:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:39:27Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 86, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.149.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:40:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:40:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.227.28", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:40:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:40:20Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(ssh) payload size incorrect for the given payload", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.216.149.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:42:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:42:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:43:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:44:13Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T00:44:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:45:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.201.127.108", "classifications": [], "first_seen": { "$date": "2023-07-02T00:46:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T00:46:26Z" }, "ports": [ 474 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 5, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.150.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T01:01:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T01:01:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.208.82.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T01:02:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T01:02:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.135.73.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T01:06:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T01:06:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.42.5.47", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T01:10:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:03:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 75, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.117.252.192", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-02T01:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T01:14:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP traceroute" ], "sightings": 70, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "205.205.150.52", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-07-02T01:41:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:09:20Z" }, "ports": [ 0, 53, 161, 1900, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "(sip) content length mismatch" ], "sightings": 105, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "198.235.24.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T01:48:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T01:48:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.95.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T01:55:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T01:55:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.155.154", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T01:57:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:19:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 125, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "216.218.206.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:01:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:01:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "54.175.28.231", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T02:03:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:34:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 150, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:14:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:15:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.123.178.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:17:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:17:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:20:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:20:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.210.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:24:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:24:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.69", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:28:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:28:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.250.55.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T02:37:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:37:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 9, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.196.121", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T02:38:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:53:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.217", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:41:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:41:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.97.141", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T02:42:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:22:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 210, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:44:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:45:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.3.2.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T02:45:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:01:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T02:51:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T02:51:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.224.22.101", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:01:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:01:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 195, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:01:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.190.96.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:01:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:01:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 195, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "211.154.194.21", "classifications": [], "first_seen": { "$date": "2023-07-02T03:02:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:02:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 5, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "205.210.31.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:04:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:04:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:11:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:12:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:23:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:41:23Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.108.155", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:32:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:32:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.245", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:32:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:33:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:34:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:34:49Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.165.35.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:37:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:37:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.232.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:37:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:37:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.248.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:44:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:44:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:44:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:02:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 52, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.201.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:47:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:47:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.226.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T03:50:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:04:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:51:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:51:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:51:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:52:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.160.27.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T03:52:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:09:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.203.208.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:52:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:52:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.208.35", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T03:58:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T03:58:45Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.217.7", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:02:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:02:24Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "220.85.134.179", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T04:03:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:03:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.165", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:05:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:06:19Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.65.111.17", "classifications": [], "first_seen": { "$date": "2023-07-02T04:07:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:07:56Z" }, "ports": [ 443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 5, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.87.68.211", "classifications": [ "Information Leak", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:15:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:15:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP traceroute", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 100, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.243.144.9", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:15:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:15:26Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "105.105.132.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:19:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:19:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:21:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:22:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:23:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:23:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.151.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:25:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:25:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.228.231.60", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:25:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:25:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 75, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.88.241.33", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:39:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:27:58Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 62, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.235.24.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:41:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:41:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:42:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:42:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 90, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.145.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:45:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:45:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:51:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:51:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.130.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T04:53:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T04:53:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.7.199.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T05:01:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:01:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.167.213.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:08:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:09:32Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream after TCP reset sent" ], "sightings": 44, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "196.189.126.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:08:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:23:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.142.176.176", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T05:08:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:08:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.252.21.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:09:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:04:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 150, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.52.10.84", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:10:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:27:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "89.208.107.234", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:12:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:30:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "148.101.76.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:12:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:23:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 15, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "107.170.230.9", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T05:14:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:14:08Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "41.223.6.200", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:14:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:25:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 45, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.126.11.205", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:14:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:33:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.219.231.58", "classifications": [], "first_seen": { "$date": "2023-07-02T05:14:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:14:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 5, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "31.220.53.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:15:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:31:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 55, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.125.94.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:17:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:02:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 100, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "106.51.226.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:18:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:41:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 70, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.157.23.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:18:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:38:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 65, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.163.152.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:19:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:58:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 150, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.216.92", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:27:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:43:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 50, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "212.15.105.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T05:29:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:29:17Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.32.215.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:29:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:43:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.92.159.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T05:30:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:48:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.232.130.80", "classifications": [], "first_seen": { "$date": "2023-07-02T05:36:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:36:20Z" }, "ports": [ 17405 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 5, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "198.199.119.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T05:38:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:38:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.132.53.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T05:52:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T05:52:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.228.231.86", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T06:02:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:02:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 75, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "146.88.241.63", "classifications": [ "Misc activity", "Detection of a Network Scan", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-07-02T06:07:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:07:27Z" }, "ports": [ 0, 1900, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt", "PROTOCOL-TFTP Get" ], "sightings": 70, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 4, "classification_count": 3 }, { "ioc": "212.35.72.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T06:14:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:35:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "131.221.81.197", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T06:16:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:23:43Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.49.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T06:17:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:30:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "115.244.236.10", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T06:17:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:34:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.219.251.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T06:19:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:32:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "188.166.208.174", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T06:20:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:32:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "141.98.6.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T06:20:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:30:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 82, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "50.21.179.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T06:22:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:56:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.241.227.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T06:25:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:06:24Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "156.59.207.206", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T06:26:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:26:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "121.190.137.170", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T06:27:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:27:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T06:51:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T06:51:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.243.102.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T07:07:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:07:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.137.118.41", "classifications": [], "first_seen": { "$date": "2023-07-02T07:11:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:11:11Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.230.58.133", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T07:20:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:58:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "197.134.215.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T07:30:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:30:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.193", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T07:36:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:03:00Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.108.181.237", "classifications": [], "first_seen": { "$date": "2023-07-02T07:41:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T07:41:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.173.85.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T07:45:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:01:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T07:49:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:50:58Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 46, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "130.162.136.157", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T07:59:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:12:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.243.130.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T08:35:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:35:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "14.161.12.119", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T08:35:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:21:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "189.78.142.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T08:35:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:35:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.213.120.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T08:35:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:59:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 116, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.133.106", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T08:36:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:52:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.200.116.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T08:47:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:43:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.131.41.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T08:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:38:09Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 82, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.26.135.37", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-02T08:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:13:15Z" }, "ports": [ 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 8, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.92.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T08:56:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:12:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.68.187.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T08:58:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T08:58:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.72.132.129", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T08:58:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:08:27Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 66, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.101.190.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T08:59:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:12:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "132.157.66.71", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:06:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:06:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.238.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:10:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:10:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.229.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:10:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:10:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.154.22.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T09:14:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:14:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.97.210.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:17:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:28:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.127.50.169", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:19:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:19:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.28.9.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:20:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:20:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.35.18.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:27:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:47:27Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:32:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:36:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.63.196.55", "classifications": [], "first_seen": { "$date": "2023-07-02T09:33:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:53:01Z" }, "ports": [ 44391, 21443, 29443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 12, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "206.189.64.15", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:36:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:36:54Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "43.156.49.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T09:40:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:56:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:40:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.95.90.184", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T09:41:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:58:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "147.182.224.240", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T09:42:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:59:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "49.248.16.146", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T09:45:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:03:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.62.197.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:46:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:54:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.147.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T09:56:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:08:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T09:58:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T09:58:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "4.240.48.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T09:59:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:15:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.248.163.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:10:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:44:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.241.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:10:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:11:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:32:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.216.203.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:14:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:14:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.155.152.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:15:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:29:51Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.208", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:19:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:19:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.195", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:20:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:20:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.169.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:26:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:26:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T10:56:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T10:56:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.169.81.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T11:06:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:45:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.221.153.188", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T11:17:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T11:17:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T11:18:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T11:18:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T11:26:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T11:26:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.117.128", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-02T11:37:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T11:37:13Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP NULL command attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "34.105.67.37", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T11:37:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:27:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 120, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "147.192.18.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T11:49:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T11:50:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.109.177.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T11:59:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:15:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.49.1.28", "classifications": [], "first_seen": { "$date": "2023-07-02T12:01:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:01:45Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 4, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "107.170.232.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T12:03:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:03:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T12:24:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:53:35Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T12:24:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:24:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.238.0.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T12:24:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:24:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "173.82.240.202", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T12:28:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:43:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "38.180.22.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T12:29:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:47:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "39.109.85.40", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T12:30:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:30:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T12:38:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:08:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.154.246", "classifications": [], "first_seen": { "$date": "2023-07-02T12:51:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:51:05Z" }, "ports": [ 8081 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "221.231.15.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T12:55:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T12:55:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "49.145.231.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T13:06:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:06:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.228.161.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T13:30:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:30:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "192.241.213.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T13:31:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:31:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.241", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T13:50:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:50:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.75.254.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T13:51:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:51:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T13:57:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T13:57:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T14:18:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:20:01Z" }, "ports": [ 0, 1434 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "SQL ping attempt" ], "sightings": 54, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "121.7.81.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T14:21:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:21:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "191.101.232.123", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T14:24:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:05:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 96, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.224.38.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T14:27:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:39:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T14:33:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:56:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.186.103.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T14:33:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:33:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.148.108.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T14:52:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T14:52:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "148.153.110.76", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:00:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:16:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.105.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:02:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:19:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.185.13.171", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:03:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:04:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T15:04:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:07:40Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 34, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "182.70.241.35", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:06:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:19:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "46.101.235.155", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:06:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:19:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.176.147.25", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:06:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:23:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 64, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.112.123", "classifications": [], "first_seen": { "$date": "2023-07-02T15:07:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:46:45Z" }, "ports": [ 443 ], "reporting_nodes": 2, "rules": [ "(port_scan) TCP portscan" ], "sightings": 8, "tags": [ "tcp", "https" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "208.109.15.199", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:27:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.13.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:09:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T15:27:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T15:14:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:16:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.196.89.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T15:28:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:11:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T15:30:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:41:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T15:31:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:22:09Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.111.134.166", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:54:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:09:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.107.182.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T15:55:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:12:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.186.106", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-02T16:01:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:01:43Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "8.222.226.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T16:01:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:41:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 52, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.235.184.45", "classifications": [ "Misc activity", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-07-02T16:03:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:19:37Z" }, "ports": [ 0, 1900 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "INDICATOR-SCAN UPnP service discover attempt" ], "sightings": 20, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "178.128.47.46", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T16:04:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:19:40Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 72, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "83.103.250.246", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T16:05:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:19:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "91.238.230.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T16:14:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:30:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "176.113.115.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T16:18:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:18:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "169.47.111.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T16:39:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:39:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.175.21.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T16:42:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:42:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.235.6.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T16:55:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T16:55:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.1.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T17:03:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:03:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.236.78.187", "classifications": [], "first_seen": { "$date": "2023-07-02T17:03:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:03:32Z" }, "ports": [ 58426 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.211.190", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T17:24:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:24:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.12.143.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T17:25:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:25:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T17:30:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:30:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.93.16.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T17:33:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:16:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 64, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T17:40:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:19:45Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.243.20.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T17:58:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:58:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T17:59:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T17:59:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.200", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T18:00:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:00:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T18:05:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:05:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.204.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T18:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:06:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T18:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:15:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T18:15:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:15:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.233", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T18:35:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:35:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T18:52:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T18:52:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "92.96.19.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:02:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:02:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:07:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:07:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.198.191.235", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:07:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:07:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:07:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:07:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "219.147.205.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:07:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:07:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.172.106.166", "classifications": [], "first_seen": { "$date": "2023-07-02T19:07:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:07:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP redirect host", "ICMP Traffic Detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "185.210.85.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:15:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:15:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:25:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:25:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:31:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:31:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "125.136.203.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T19:34:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:34:47Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.177.182.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:40:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:55:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.151", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:42:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T19:42:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T19:53:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:23:14Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.35", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:03:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:03:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.72.6.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T20:09:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:25:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.246.145.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:09:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:09:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:10:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:05:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.133.10.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:12:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:12:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.228.24", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:15:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:15:21Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "82.146.35.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T20:16:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:37:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.234.2.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T20:16:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:01:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "203.23.199.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T20:17:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:07:13Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "47.236.27.212", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T20:20:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:33:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "220.94.228.163", "classifications": [ "Executable code was detected", "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:21:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:18:34Z" }, "ports": [ 22, 0 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) reset outside window", "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) SYN on established session", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "(port_scan) TCP portscan", "(stream_tcp) data sent on stream after TCP reset sent" ], "sightings": 260, "tags": [ "tcp", "ssh", "icmp" ], "rule_count": 7, "classification_count": 2 }, { "ioc": "211.199.187.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T20:29:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:29:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:38:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:54:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.234.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:39:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:39:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:42:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:42:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:52:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:02:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.147.17", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:58:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:31:39Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.246.23", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T20:59:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T20:59:02Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "103.143.248.87", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T21:07:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:26:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.93.125", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:10:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:10:22Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "35.203.210.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:10:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:47:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.8.244", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T21:10:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:26:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.5.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T21:11:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:31:42Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.149.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T21:11:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:26:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:11:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:11:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "206.217.143.171", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:14:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:14:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.144.26", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:14:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:14:17Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:14:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:14:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:19:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:19:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.225.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:22:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:22:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:23:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:03:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.230.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:23:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:23:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "111.96.203.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:26:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:26:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:27:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:27:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.228.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:28:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:28:53Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "170.51.110.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:28:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:30:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.118.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:37:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:07:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.0.227.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T21:54:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T21:54:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 7, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.62", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T21:55:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:11:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.155.91.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:01:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:01:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 32, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:08:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.151.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:08:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:08:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.74.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:09:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:09:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "87.121.221.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:11:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:01:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 48, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.122", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:22:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:22:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.226.107.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:27:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:27:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.31", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:28:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:24:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:31:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:31:31Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.32.165.114", "classifications": [], "first_seen": { "$date": "2023-07-02T22:34:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:34:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "(ssh) payload size incorrect for the given payload" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "35.203.211.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:40:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:28:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.82.218.33", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-02T22:40:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:40:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.8.93.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:40:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:40:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.184", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:46:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:46:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:47:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:47:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T22:53:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T22:53:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.165.216", "classifications": [], "first_seen": { "$date": "2023-07-02T23:00:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:02:17Z" }, "ports": [ 9999, 5139 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 8, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.150.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T23:11:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:11:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.20.182.46", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T23:23:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:23:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.94.138.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T23:23:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:23:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.147", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T23:24:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:24:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.64.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T23:24:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:24:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T23:36:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:36:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "72.36.21.74", "classifications": [], "first_seen": { "$date": "2023-07-02T23:41:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:41:17Z" }, "ports": [ 24105 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "179.43.143.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T23:42:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:42:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Timestamp Request", "(icmp4) ICMP ping Nmap", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Timestamp Reply", "PROTOCOL-ICMP Echo Reply" ], "sightings": 54, "tags": [ "icmp" ], "rule_count": 6, "classification_count": 1 }, { "ioc": "107.170.243.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-02T23:49:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-02T23:49:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.131.128.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:04:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:04:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:11:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:11:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "169.48.204.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:13:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:13:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.196", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:19:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:19:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:21:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:21:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "91.121.223.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:23:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:23:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.123.117.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:26:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:26:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "196.41.37.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T00:30:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:30:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "184.105.247.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:32:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:32:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:33:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:33:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:40:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:40:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.202.190.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:46:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:46:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "52.208.30.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:48:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:48:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.248.163.203", "classifications": [], "first_seen": { "$date": "2023-07-03T00:48:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:50:31Z" }, "ports": [ 8090, 5555 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 8, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "71.6.233.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:49:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:49:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T00:57:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T00:57:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:07:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:07:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:07:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:15:43Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 44, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:15:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:42:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.255.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:20:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:20:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:27:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:27:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.254.97.34", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:28:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:28:07Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "180.108.106.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:32:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:32:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "35.203.211.126", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:42:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:42:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "218.248.29.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:43:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:43:55Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.16.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:45:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:47:32Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:45:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:45:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:47:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:52:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "34.100.196.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T01:48:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:05:38Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "71.6.233.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:48:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:48:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.119.233", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T01:49:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:07:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "194.48.217.99", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:50:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:50:49Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "209.14.71.152", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T01:51:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:08:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.141.87.100", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:52:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:13:45Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "71.6.233.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T01:54:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T01:54:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.248.35", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:01:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:01:07Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "205.210.31.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:08:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:08:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.62.82.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:13:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:13:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "163.172.34.166", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:31:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.129.183.214", "classifications": [], "first_seen": { "$date": "2023-07-03T02:20:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:20:52Z" }, "ports": [ 36107 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 16, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.125.161.93", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T02:20:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:20:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.63.151.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:31:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:16:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.139", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:34:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:34:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:35:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:35:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.59.10.188", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T02:37:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:14:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 120, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.145.85.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T02:38:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:53:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "108.30.141.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:38:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:38:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.120.176.4", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T02:40:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:52:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.92.16.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T02:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:57:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "67.216.211.177", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T02:46:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:05:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.185.25.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:51:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:51:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T02:57:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T02:57:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.177.245", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-03T03:04:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:40:41Z" }, "ports": [ 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 8, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "193.41.226.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:07:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:12:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.194.172", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T03:16:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:37:53Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 96, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.215.85", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T03:18:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:36:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.206.238.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T03:20:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:41:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "68.168.135.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T03:22:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:40:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "88.202.190.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:23:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:23:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.64", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:27:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:15:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "183.159.173.197", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:30:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:30:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:30:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:30:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.49", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:35:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:35:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "42.240.133.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:36:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:36:42Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.162.47.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:41:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:41:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.136.227.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T03:44:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:44:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "15.235.208.6", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:51:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:51:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.38.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:51:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:51:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.191.14.198", "classifications": [], "first_seen": { "$date": "2023-07-03T03:55:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:55:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP destination unreachable communication with destination host is administratively prohibited", "ICMP Traffic Detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "5.63.151.113", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T03:59:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T03:59:16Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "35.203.211.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:02:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:02:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.16.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:05:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:05:01Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.63.151.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:06:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:06:04Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "45.56.67.214", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:08:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:08:32Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "117.35.207.219", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:09:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "162.216.149.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:09:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:09:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "24.84.212.161", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T04:09:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:09:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.84.31.108", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T04:10:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:10:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "183.251.148.186", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:16:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:16:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.63.151.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:20:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:20:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:21:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:21:09Z" }, "ports": [ 0, 5632 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "APP-DETECT PCAnywhere server response" ], "sightings": 17, "tags": [ "icmp", "udp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "223.205.219.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:21:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:21:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "198.235.24.226", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T04:22:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:22:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "156.241.132.37", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:32:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:32:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:33:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:33:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:46:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:46:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.68", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:56:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:56:05Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.149.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T04:59:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T04:59:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.62.197.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:00:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:00:26Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.61.186.142", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:09:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:02:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:02:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:07:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:07:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.160.252", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:08:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:08:25Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:09:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:09:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.111.224.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:20:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:20:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.165", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:28:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:28:05Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.20.200.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T05:38:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:38:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.64.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:38:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:38:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.212.158.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:46:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:46:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.232", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T05:49:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:49:04Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "176.215.255.242", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T05:59:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T05:59:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.152.145.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T06:11:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:11:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "200.17.132.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T06:29:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:49:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 44, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "71.6.233.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T06:31:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:31:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "176.124.199.224", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T06:32:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:43:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T06:58:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T06:58:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.246.78.231", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:08:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:08:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "71.6.233.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:09:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:09:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.140.61.206", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T07:18:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:40:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.71.202.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T07:21:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:38:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 39, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.185.25.189", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:22:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:22:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.223.122.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:22:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:22:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "61.141.87.250", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:24:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:24:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.88.90.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:34:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:54:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:34:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:34:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.52.237.130", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:35:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:35:15Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 9, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.99.146.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:36:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:36:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.104.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T07:42:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:01:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 42, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:42:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:22:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T07:47:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:47:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.43.154.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T07:47:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:18:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 90, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.182.72.250", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T07:49:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:02:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 33, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "67.164.238.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T07:50:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T07:50:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "116.58.254.168", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T08:06:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:06:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.63.151.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T08:19:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:19:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "216.31.0.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T08:21:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:21:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.236.19.129", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T08:27:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:27:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.88", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T08:28:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:28:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.153.67.248", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T08:31:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:47:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "71.6.233.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T08:41:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:41:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.141.87.81", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T08:43:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:52:46Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 28, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.131", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T08:49:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T08:49:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "157.245.94.212", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T09:02:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:02:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "88.202.190.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T09:13:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:13:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.236.22.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T09:23:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:23:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "144.91.109.63", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T09:31:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:31:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "137.184.220.109", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T09:52:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T09:52:24Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "109.123.117.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T10:10:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:10:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.112.196.1", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T10:13:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:35:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.59.67.215", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T10:15:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:15:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "148.72.247.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T10:16:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:23:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "123.253.34.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T10:43:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:51:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "116.62.63.121", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T10:54:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T10:54:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T11:18:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:12:04Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T11:19:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T11:19:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.185.25.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T11:25:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T11:25:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.236.28.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T11:30:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T11:30:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.79.185.69", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-07-03T11:39:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:25:22Z" }, "ports": [ 111, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "221.230.30.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T11:44:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T11:44:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "79.178.160.211", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-03T11:46:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T11:46:19Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "5.63.151.118", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-07-03T11:46:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:15:37Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "71.6.233.206", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-07-03T11:47:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T11:47:51Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "85.244.21.91", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T12:10:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:10:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "220.95.34.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T12:12:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:12:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.18.15.70", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T12:14:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:38:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.106.191.227", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T12:16:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:32:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "31.179.234.178", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T12:16:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:37:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "5.8.93.160", "classifications": [], "first_seen": { "$date": "2023-07-03T12:17:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:04:00Z" }, "ports": [ 80 ], "reporting_nodes": 2, "rules": [ "(tcp) XMAS attack detected", "(tcp) TCP SYN with RST", "(tcp) TCP SYN with FIN" ], "sightings": 12, "tags": [ "tcp", "http" ], "rule_count": 3, "classification_count": 0 }, { "ioc": "104.248.158.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T12:20:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:32:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "181.127.185.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T12:20:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:21:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.160.208.34", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T12:21:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:33:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "177.232.85.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T12:28:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T12:28:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "113.161.206.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T13:03:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T13:03:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.44.249.34", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T13:14:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:03:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "218.188.54.90", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T13:19:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T13:19:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "222.139.206.133", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T13:30:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T13:30:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "89.190.203.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T13:31:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T13:53:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.144.57.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T13:42:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:19:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.207.94.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T13:52:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T13:52:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "43.230.203.56", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-03T14:05:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:02:42Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "210.103.87.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T14:17:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:17:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.195.243.76", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T14:26:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:04:00Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.182.144.93", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T14:30:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:30:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "104.128.190.249", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T14:59:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T14:59:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "38.111.114.71", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T15:07:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:07:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "139.198.33.147", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T15:10:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:10:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.209.40.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T15:13:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:13:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.76.203", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T15:29:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:29:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.6", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-03T15:34:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:34:31Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "65.49.1.12", "classifications": [], "first_seen": { "$date": "2023-07-03T15:37:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:37:13Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "34.150.78.225", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T15:45:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:45:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "79.101.50.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T15:54:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T15:54:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.56.79.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:00:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:17:02Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.112.150.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:05:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:05:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.195.176.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T16:11:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:12:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.63.151.107", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:15:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:15:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.209.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:15:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:37:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.99.170.229", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:16:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:31:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 18, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.168.87.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:29:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:29:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "119.189.246.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:32:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:32:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.123.117.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:44:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:44:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.197.39", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:46:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:49:53Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "71.6.233.87", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T16:52:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:52:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "122.162.242.142", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T16:59:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T16:59:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "210.100.250.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:03:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:59:29Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:20:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:20:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:28:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:28:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.51", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:30:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:53:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "115.144.5.228", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T17:33:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:48:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.83", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:37:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:37:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "170.187.197.41", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:40:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:19:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.193", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:41:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:32:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:43:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:43:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.65", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:45:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:13:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:47:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:47:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.70", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:52:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:26:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.33", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:54:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:54:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "199.119.65.87", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:55:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:15:28Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "23.154.136.97", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:55:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:00:10Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "45.233.139.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T17:59:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T17:59:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.89.30.140", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:05:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:05:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:16:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:16:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.134.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:17:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:17:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.71.126.150", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:20:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:20:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "93.135.125.103", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T18:22:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:57:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.238.216.206", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:28:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:28:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.128.87.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:38:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:44:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:40:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:40:25Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "44.200.200.172", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:40:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:07:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "180.169.160.221", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T18:49:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:49:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.110", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:52:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:52:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "13.245.28.120", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T18:56:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T18:56:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "102.130.49.212", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:03:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:03:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.142.125.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:03:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:03:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.124.155.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:08:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:08:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:09:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:09:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.136.146.30", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:09:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:09:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "192.241.135.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T19:10:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:31:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.134.97.176", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T19:10:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:32:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.89.28.11", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:12:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:12:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.154.183.138", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T19:13:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:42:03Z" }, "ports": [ 22 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 54, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "82.102.12.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T19:13:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:35:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "129.28.148.122", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:20:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:20:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "161.35.21.48", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T19:30:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:50:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.210.31.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:40:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:40:54Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:50:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:50:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.98", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T19:53:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T19:53:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.223.135.216", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T19:56:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:17:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.190.121.89", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T19:57:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:31:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "67.205.177.222", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T19:58:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:17:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.145.101.152", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:03:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:03:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.202", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:03:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:03:57Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.216.150.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:07:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:57:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.152.245.19", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T20:23:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:44:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:24:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:24:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.184.199.39", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T20:24:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:41:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.209.240.18", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T20:27:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:43:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "131.196.198.104", "classifications": [], "first_seen": { "$date": "2023-07-03T20:33:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:35:02Z" }, "ports": [ 53979 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 10, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "8.137.20.205", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:37:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:37:35Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "182.239.108.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T20:37:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:37:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.200.118.73", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:41:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:52:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.217.232.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:51:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:51:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.235.63.128", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:52:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:52:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "117.194.151.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T20:58:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T20:58:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T21:05:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T21:05:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T21:10:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T21:10:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.219.235.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T21:28:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:56:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.125", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T21:31:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T21:31:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T21:33:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:53:24Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "35.203.210.27", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T21:44:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T21:44:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.163.125.145", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-03T22:04:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:04:38Z" }, "ports": [ 705 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP AgentX/tcp request" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "93.87.123.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:07:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:07:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.211.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T22:10:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:24:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.77.90.182", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T22:13:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:28:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "192.88.99.1", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:13:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:13:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:14:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:14:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.132.180.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T22:15:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:32:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:20:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:20:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:21:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:21:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:29:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:15:31Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "193.163.125.28", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-03T22:48:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:48:32Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 2, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.187", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:52:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:52:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:53:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:53:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.242", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:56:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:50:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.185", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:57:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T22:57:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.52", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T22:57:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:25:58Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T23:07:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:29:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "124.123.123.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T23:08:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T23:08:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "45.251.41.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T23:21:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T23:59:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.172", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T23:31:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T23:31:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "222.104.132.88", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-03T23:37:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T23:38:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.102", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T23:38:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-03T23:38:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.196.203.176", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-07-03T23:39:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:39:06Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "172.104.126.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-03T23:41:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:13:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.121", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:02:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:02:07Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "178.79.155.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:07:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:22:56Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:15:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:15:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:16:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:16:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.77", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:19:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:03:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.187.6.30", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T00:19:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:33:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:21:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:21:13Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:37:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:37:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.236", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:45:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:45:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.246", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:48:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:48:16Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.149.14", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:50:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:50:01Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:50:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:50:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.144.186.165", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:52:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:53:37Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "118.42.157.48", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T00:59:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T00:59:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "112.28.209.251", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T01:10:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:10:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.217.122.23", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T01:15:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:15:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.130.151.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T01:15:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:31:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "34.145.163.76", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T01:16:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:13:03Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 80, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "47.180.114.229", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T01:16:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:51:04Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.102.114", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T01:20:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:20:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 40, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.114.218", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-04T01:29:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:29:03Z" }, "ports": [ 162 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP trap tcp" ], "sightings": 2, "tags": [ "tcp", "snmptrap" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.248.133.158", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T01:49:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:49:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T01:51:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:51:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.243", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T01:59:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T01:59:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.101.116.114", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T02:06:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:29:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "111.16.39.164", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T02:09:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:09:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.147.51.54", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T02:09:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:23:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.180.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T02:10:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:18:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "207.154.241.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T02:10:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:27:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "104.148.65.208", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T02:11:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:29:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.108.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T02:12:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:29:00Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.167", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T02:12:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:12:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "179.99.212.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T02:14:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:18:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.149.111", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T02:27:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:27:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "98.255.219.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T02:29:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:29:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "194.233.167.225", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T02:32:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:31:20Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "223.113.229.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T02:45:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T02:45:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:01:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:01:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.138.69.68", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T03:01:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:03:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "207.211.214.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:01:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:01:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 60, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "117.90.50.40", "classifications": [], "first_seen": { "$date": "2023-07-04T03:02:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:02:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.150.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:03:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:03:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.98.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:08:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:08:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.1.14", "classifications": [], "first_seen": { "$date": "2023-07-04T03:11:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:11:41Z" }, "ports": [ 80 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp", "http" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "62.112.8.150", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:22:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:15:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "78.134.38.138", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:31:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:31:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "27.40.123.59", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:34:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:34:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "165.154.128.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:52:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:52:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "102.221.249.143", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T03:54:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:54:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "159.223.40.178", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:57:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:57:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.240", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T03:59:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T03:59:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.3", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:05:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:05:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "164.92.193.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T04:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:29:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "119.239.149.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:15:29Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.90.116.158", "classifications": [], "first_seen": { "$date": "2023-07-04T04:15:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:01:54Z" }, "ports": [ 56350, 44855 ], "reporting_nodes": 2, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.170.204.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T04:16:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:32:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "62.210.202.112", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:18:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:42:41Z" }, "ports": [ 65476, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "177.131.118.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T04:20:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:37:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.199.94.60", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:27:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:27:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "229.155.64.135", "classifications": [], "first_seen": { "$date": "2023-07-04T04:34:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:34:42Z" }, "ports": [ 28429 ], "reporting_nodes": 1, "rules": [ "(ipv4) IPv4 packet from multicast source address" ], "sightings": 2, "tags": [ "udp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "220.135.188.94", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:34:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:34:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Destination Unreachable Protocol Unreachable" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.223", "classifications": [ "Executable code was detected", "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:38:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:11:18Z" }, "ports": [ 22, 161, 0 ], "reporting_nodes": 2, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "tcp", "ssh", "udp", "snmp", "icmp" ], "rule_count": 5, "classification_count": 3 }, { "ioc": "162.216.149.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:49:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:49:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.213", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:51:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:51:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "68.183.236.24", "classifications": [], "first_seen": { "$date": "2023-07-04T04:53:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:53:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(http_inspect) invalid status line", "(http_inspect) not HTTP traffic or unrecoverable HTTP protocol error" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "162.216.149.79", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T04:58:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T04:58:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T05:05:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:05:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.220", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T05:05:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:05:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.101", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T05:15:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:50:06Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T05:16:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:16:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.223.45.9", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T05:16:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:16:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T05:18:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:18:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.90", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T05:21:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:25:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "143.244.181.123", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T05:26:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:45:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.247.37.71", "classifications": [], "first_seen": { "$date": "2023-07-04T05:35:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:35:55Z" }, "ports": [ 18577 ], "reporting_nodes": 1, "rules": [ "(tcp) experimental TCP options found" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "54.173.84.231", "classifications": [], "first_seen": { "$date": "2023-07-04T05:54:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T05:54:26Z" }, "ports": [ 7443 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "161.18.104.31", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T06:06:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:06:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.23.249.135", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T06:11:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:31:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.242.163.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T06:12:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:28:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "76.154.212.220", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T06:13:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:44:07Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 42, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.33.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T06:15:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:25:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 16, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "97.64.22.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T06:19:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:31:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.79.155.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T06:36:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:50:11Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.239.12.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T06:41:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:30:15Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.89", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T06:51:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:51:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.62.32.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T06:52:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:52:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "38.7.199.180", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T06:55:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T06:55:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "64.227.13.96", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T06:58:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:20:22Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "59.13.156.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T07:45:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:46:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "59.29.145.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T07:48:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:48:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.122.23.134", "classifications": [ "Information Leak", "Misc activity", "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-04T07:52:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T07:53:21Z" }, "ports": [ 0, 161 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 64, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "192.241.220.29", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:08:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:08:55Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "192.241.225.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:11:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:11:19Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.135.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:21:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:21:19Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "211.219.44.209", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T08:23:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:23:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.147.4", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:29:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:29:19Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "198.199.104.14", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:32:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:32:16Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "107.170.239.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:37:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:37:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.132.109.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:43:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:44:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "152.67.46.19", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:46:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:46:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "221.149.176.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T08:47:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:48:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.221.6", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:55:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:55:24Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.231.9", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:56:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:56:29Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.235.24.212", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T08:58:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T08:58:37Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "107.170.252.18", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T09:03:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:03:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.96.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T09:07:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:07:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "134.209.176.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T09:10:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:10:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.213.249", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T09:24:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:35:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.135.42.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T09:26:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:45:14Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "202.44.54.100", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T09:30:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:51:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.74.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T09:34:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:59:54Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.224.17", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T09:52:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:52:51Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "162.243.129.34", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T09:53:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T09:53:06Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 1, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "198.235.24.108", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T10:21:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:20:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 5, "classification_count": 2 }, { "ioc": "113.107.69.10", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T10:24:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:24:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "194.195.241.170", "classifications": [ "Attempted Denial of Service", "Misc activity" ], "first_seen": { "$date": "2023-07-04T10:27:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:51:33Z" }, "ports": [ 53, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-DNS DNS query amplification attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "178.79.160.253", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T10:31:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:56:05Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.169.183.42", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T10:36:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:53:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "201.173.78.104", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T10:40:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:40:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "51.250.106.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T10:40:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:55:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 10, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "191.188.23.86", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T10:41:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:39:02Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.209.103.181", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T10:42:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:57:36Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.45.125", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T10:42:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:14:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "118.174.0.244", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T10:44:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:44:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.226.147.100", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T10:53:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:16:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.236.176.105", "classifications": [], "first_seen": { "$date": "2023-07-04T10:56:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T10:56:27Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "115.133.237.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T10:57:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:17:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 34, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.7.79.190", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T10:57:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:13:25Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "125.141.72.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T11:00:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:01:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.224.232.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T11:04:19Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:00:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 78, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "123.186.144.139", "classifications": [], "first_seen": { "$date": "2023-07-04T11:13:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:13:08Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "(ssh) payload size incorrect for the given payload" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "103.153.136.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T11:28:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:02:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 50, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.31.210.14", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T11:30:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T11:30:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "65.126.41.34", "classifications": [], "first_seen": { "$date": "2023-07-04T12:12:29Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:12:29Z" }, "ports": [ 13543 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "139.144.186.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T12:15:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:22:25Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.90.203.131", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:17:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:11:54Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is missing" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.171.84.43", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:18:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:39:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "84.54.51.110", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:30:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:30:55Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.61.51.185", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:34:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:53:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "207.226.217.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:36:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:52:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "73.199.108.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:36:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:55:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) data sent on stream not accepting data" ], "sightings": 34, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.163.223.63", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:36:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:55:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.172.205.162", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:37:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:54:57Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "42.51.49.136", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T12:38:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:38:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.104.72.108", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T12:38:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:18:22Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.159.52.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:39:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T12:50:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "200.105.183.118", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:52:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:11:23Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.219.248.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:52:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:05:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 12, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "157.245.63.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:54:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:10:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "102.223.92.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T12:59:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:22:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 68, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.121.221.78", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T13:12:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:12:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "129.82.138.31", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T13:15:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:15:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "8.222.178.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T13:18:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:18:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.219.234.145", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T13:26:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:42:32Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 8, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "178.62.105.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T13:33:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T13:49:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.64.163.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T14:00:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:00:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.111.8.32", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T14:14:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:14:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.96.151.81", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T14:14:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:51:19Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.12.218.44", "classifications": [], "first_seen": { "$date": "2023-07-04T14:15:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:17:11Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 4, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "112.133.204.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T14:17:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:17:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "154.92.110.64", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T14:24:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:40:28Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "190.85.108.186", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T14:24:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:45:15Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "64.227.35.112", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T14:27:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:46:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.88.90.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T14:28:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:41:33Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.138.29.148", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T14:29:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:41:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.105.18.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T14:40:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:31:57Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.126.195", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T14:40:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:48:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.208.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T14:42:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:54:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.64.187.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T14:55:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T14:55:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "95.40.210.13", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T15:02:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:02:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "174.138.185.22", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-07-04T15:07:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:25:16Z" }, "ports": [ 5060, 0, 5062, 5061 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 15, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "138.197.102.17", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:19:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:38:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "143.110.248.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:19:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:42:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.189.220.0", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:19:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:41:17Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "124.158.147.21", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:19:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:39:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "132.145.150.210", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:20:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:37:59Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "109.123.242.109", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:22:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:54:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "205.205.150.28", "classifications": [ "Misc activity", "Attempted Information Leak", "Detection of a Network Scan" ], "first_seen": { "$date": "2023-07-04T15:27:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:09:03Z" }, "ports": [ 0, 53, 161, 1900, 5060 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-DNS named version attempt", "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "INDICATOR-SCAN UPnP service discover attempt", "(sip) content length mismatch" ], "sightings": 42, "tags": [ "icmp", "udp", "snmp" ], "rule_count": 7, "classification_count": 3 }, { "ioc": "187.149.180.236", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:32:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:53:09Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "103.144.31.76", "classifications": [], "first_seen": { "$date": "2023-07-04T15:37:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:37:40Z" }, "ports": [ 17976 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) reset outside window" ], "sightings": 6, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "206.81.19.180", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:38:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:53:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.74.5.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:39:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:55:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.57.69", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T15:39:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:53:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "51.178.25.97", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T15:45:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:45:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.174.217.98", "classifications": [], "first_seen": { "$date": "2023-07-04T15:57:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T15:57:59Z" }, "ports": [ 55061 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "118.193.59.15", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T16:08:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:08:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.44.247.73", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T16:13:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:32:56Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.213.27.8", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T16:14:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:28:21Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "185.224.128.148", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T16:17:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:59:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.71.234.134", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-04T16:20:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:34:39Z" }, "ports": [ 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 4, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "139.144.186.157", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T16:21:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:00:44Z" }, "ports": [ 1434, 0 ], "reporting_nodes": 2, "rules": [ "SQL ping attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "24.84.144.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T16:37:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:37:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.235.13.30", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T16:46:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T16:46:46Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.168.59.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T17:00:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:53:16Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.199", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T17:10:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:10:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.227.191.40", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T17:17:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:17:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.228", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T17:19:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:19:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T17:34:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:34:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T17:45:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:45:32Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.34.27.72", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T17:50:02Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:50:02Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.231.63.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T17:58:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T17:58:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "18.214.40.3", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:02:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:09:24Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "82.212.107.230", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T18:02:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:26:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 56, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "117.202.18.2", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T18:02:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:33:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "31.24.200.23", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T18:03:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:23:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.55.49.150", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T18:05:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:21:58Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "141.98.102.243", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T18:05:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:56:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 60, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.156.77.105", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T18:05:46Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:21:48Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.155.170.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T18:07:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:23:12Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.157.5.232", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:09:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:09:12Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "201.182.67.245", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T18:12:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:33:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.95", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:13:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:13:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.234", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:15:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:15:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.199.100.69", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-04T18:15:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:15:04Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 2, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.120", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:16:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:16:52Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "109.252.227.162", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:19:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:19:09Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "(icmp4) ICMP ping Nmap", "ICMP Traffic Detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 1 }, { "ioc": "187.194.17.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:30:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:30:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "23.236.58.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:30:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:30:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:33:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:33:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.224", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:43:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:43:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "138.68.83.82", "classifications": [], "first_seen": { "$date": "2023-07-04T18:45:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:45:33Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 2, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "35.203.210.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T18:49:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T18:49:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "190.211.252.50", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T19:02:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:05:39Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T19:02:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:02:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T19:20:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:20:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.80", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T19:34:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:34:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.160.236.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T19:35:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:55:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T19:42:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:42:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.223", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T19:49:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T19:49:47Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "77.68.95.215", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T19:50:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:04:06Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.154.106.189", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T19:52:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:03:16Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.42", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:06:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:06:44Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.141", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:22:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:22:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.83.64.99", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:23:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:23:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.66.230.161", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:39:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:55:47Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.106", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:40:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:40:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.36", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:41:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:43:08Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.18.56.211", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:50:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:50:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "185.200.118.53", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:50:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:21:41Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.102.122", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T20:52:32Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:07:52Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T20:56:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T20:56:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "128.14.133.58", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:02:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:02:51Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.211.92", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:03:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:03:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "140.228.24.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:05:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:05:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.156.37.41", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:12:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:27:53Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.211.230", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:16:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:16:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "171.244.28.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:20:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:02:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "198.235.24.112", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:21:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:21:57Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "195.49.210.26", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:23:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:40:39Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 22, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "90.187.219.149", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:24:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:02:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler", "(stream_tcp) TCP timestamp is outside of PAWS window" ], "sightings": 48, "tags": [ "tcp", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.208.253.98", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:25:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:44:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "138.122.201.91", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:27:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:47:03Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 18, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "152.32.227.252", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-04T21:28:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:28:47Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 2, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.149.39.163", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:29:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:29:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.247", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:34:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:34:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:40:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:40:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.29.220.74", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:43:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:03:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "208.123.138.58", "classifications": [], "first_seen": { "$date": "2023-07-04T21:43:47Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:43:47Z" }, "ports": [ 38955 ], "reporting_nodes": 1, "rules": [ "(stream_tcp) data on SYN packet" ], "sightings": 2, "tags": [ "tcp" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "209.38.225.218", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:45:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:05:50Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "85.208.253.115", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:49:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:09:44Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 40, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.227.175.44", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T21:50:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:06:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "165.154.128.222", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T21:53:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T21:53:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.230.103.248", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-04T22:05:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:05:53Z" }, "ports": [ 161 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 2, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "45.83.66.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T22:06:39Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:06:39Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T22:09:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:29:28Z" }, "ports": [ 5632, 0 ], "reporting_nodes": 1, "rules": [ "APP-DETECT PCAnywhere server response", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "8.222.138.77", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T22:10:25Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:25:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "43.153.77.20", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T22:10:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:23:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 20, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.43.233.9", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T22:14:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:31:41Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 26, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "35.203.210.132", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T22:18:18Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:18:18Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.218", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T22:26:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:26:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.227", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T22:38:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:38:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "167.248.133.157", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-04T22:46:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:46:17Z" }, "ports": [ 69, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-TFTP root directory", "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "136.158.8.93", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T22:47:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T22:47:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.7.214", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T23:08:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:23:51Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "66.98.112.247", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-04T23:10:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:28:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "179.153.159.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T23:11:26Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:11:26Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T23:24:07Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:24:07Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.107.207", "classifications": [ "Potentially Bad Traffic", "Misc activity" ], "first_seen": { "$date": "2023-07-04T23:27:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:32:08Z" }, "ports": [ 69, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-TFTP Get", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "tftp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "57.128.200.252", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T23:30:27Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:30:27Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "186.235.198.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T23:40:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:40:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "161.35.42.21", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T23:57:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:57:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.89.154.16", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-04T23:58:06Z" }, "ja3": [], "last_seen": { "$date": "2023-07-04T23:58:06Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.22", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:00:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:00:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.233.47.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:00:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:00:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.54", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:07:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:07:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.214", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:07:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:47:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.204", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:07:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:07:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.44", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:07:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:47:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 20, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.114", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:07:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:08:52Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.154", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:07:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:36:36Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "172.105.249.109", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:13:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:13:42Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "121.129.246.57", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:16:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:16:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.173", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:19:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:19:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.124", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:39:17Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:24:37Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 14, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.194", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:40:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:25:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.144", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:40:09Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:25:07Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "142.93.39.117", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:44:21Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:44:21Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.192", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:45:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:45:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.181", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:45:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:45:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.20", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:48:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:48:24Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "36.153.150.34", "classifications": [], "first_seen": { "$date": "2023-07-05T00:51:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:51:37Z" }, "ports": [ 63599 ], "reporting_nodes": 1, "rules": [ "(tcp) TCP PDU missing ack for established session", "(tcp) TCP urgent pointer exceeds payload length or no payload" ], "sightings": 4, "tags": [ "tcp" ], "rule_count": 2, "classification_count": 0 }, { "ioc": "172.104.76.26", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T00:58:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T00:58:48Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "5.13.110.205", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:01:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:01:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.71", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:03:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:03:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "139.177.194.100", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:05:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:56:22Z" }, "ports": [ 161, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "35.203.210.68", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:08:40Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:08:40Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "74.82.47.12", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:15:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:15:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.59.202.122", "classifications": [], "first_seen": { "$date": "2023-07-05T01:21:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:30:16Z" }, "ports": [ 23 ], "reporting_nodes": 1, "rules": [ "(port_scan) TCP portscan" ], "sightings": 10, "tags": [ "tcp", "telnet" ], "rule_count": 1, "classification_count": 0 }, { "ioc": "162.216.149.175", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:25:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:25:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.103", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:28:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:28:36Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:30:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:30:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.134.202.163", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T01:30:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:45:26Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 28, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.197.122.232", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T01:39:52Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:40:18Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "104.248.18.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T01:42:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:02:24Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 32, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "112.165.212.156", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T01:47:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:05:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 36, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "167.99.202.209", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:48:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:48:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T01:48:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T01:48:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "80.235.26.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:01:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:01:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.149", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:14:33Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:14:33Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.174", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:16:36Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:09:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.251", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:20:22Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:20:22Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "107.170.251.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:24:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:24:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.243.150.15", "classifications": [ "Detection of a Network Scan", "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:27:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:27:54Z" }, "ports": [ 1900, 0 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SCAN UPnP service discover attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.241.198.85", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:38:14Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:38:14Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "84.54.51.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:41:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:41:23Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "103.26.136.173", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T02:43:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:20:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 46, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "187.190.252.164", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T02:50:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:22:01Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 62, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "87.236.176.220", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:53:31Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:53:31Z" }, "ports": [ 161, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-SNMP public access udp", "PROTOCOL-SNMP request udp", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "udp", "snmp", "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "162.216.150.202", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:54:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:54:37Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "8.222.174.179", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:55:04Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:55:04Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "1.198.50.137", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T02:59:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T02:59:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "69.164.192.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:00:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:00:45Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "189.23.184.68", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:01:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:01:17Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 30, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "163.172.103.177", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:06:57Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:06:57Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 24, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "159.203.192.10", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:11:20Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:11:20Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "45.79.109.130", "classifications": [ "Attempted Information Leak" ], "first_seen": { "$date": "2023-07-05T03:14:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:19:51Z" }, "ports": [ 161 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-SNMP request tcp" ], "sightings": 4, "tags": [ "tcp", "snmp" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "146.88.241.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:22:01Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:56:34Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 10, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "202.112.238.254", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:24:42Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:29:50Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 16, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.196.4", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:32:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:32:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.246", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:32:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:32:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.211.201", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:36:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:36:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.193.43", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:37:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:37:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.204.66", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:39:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:39:05Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.75.167.127", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:41:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:41:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.215.47", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:46:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:46:08Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 1, "rules": [ "(sip) content length mismatch", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 1 }, { "ioc": "107.170.244.25", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:46:55Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:46:55Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.104", "classifications": [ "Misc activity", "Potentially Bad Traffic" ], "first_seen": { "$date": "2023-07-05T03:50:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:31:39Z" }, "ports": [ 0, 69 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected", "PROTOCOL-TFTP Get" ], "sightings": 14, "tags": [ "icmp", "udp", "tftp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "167.172.88.82", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:54:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:54:49Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.209.56", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T03:59:28Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T03:59:28Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.209.96.90", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:01:13Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:01:13Z" }, "ports": [ 5080, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "95.244.70.217", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T04:02:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:19:49Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 24, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "134.17.16.72", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T04:03:24Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:21:30Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 30, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.155.15", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T04:04:35Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:06:40Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.216.150.160", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:05:34Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:05:34Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "195.154.177.178", "classifications": [ "Generic Protocol Command Decode", "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:10:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:30:40Z" }, "ports": [ 5060, 0 ], "reporting_nodes": 2, "rules": [ "PROTOCOL-VOIP inbound INVITE message", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 12, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "198.199.98.137", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:13:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:13:11Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "162.243.128.22", "classifications": [ "Decode of an RPC Query", "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:21:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:21:30Z" }, "ports": [ 111, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-RPC portmap listing UDP 111", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 6, "tags": [ "udp", "sunrpc", "portmapper", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "192.9.148.143", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:24:59Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:24:59Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "192.241.230.8", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:34:48Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:34:48Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "106.75.143.112", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:42:41Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T04:42:41Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "146.88.241.134", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T04:55:12Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:35:12Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "35.203.210.221", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T05:01:03Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:01:03Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.149.38", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T05:04:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:04:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "38.7.199.207", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T05:05:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:05:30Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "162.216.150.156", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T05:14:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:14:00Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "205.210.31.105", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T05:26:53Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:26:53Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "120.233.127.248", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T05:33:43Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:33:43Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 8, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "47.97.40.145", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T05:42:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:42:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "101.68.78.75", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T05:51:10Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T05:51:10Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "43.242.241.249", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T06:05:51Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:05:51Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "184.91.205.95", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T06:07:23Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:07:33Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "1.212.165.165", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T06:18:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:18:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 4, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "65.49.1.58", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T06:26:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:26:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "175.194.2.24", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T06:34:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T06:34:38Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "181.234.11.37", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T06:50:44Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:05:37Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 27, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "121.184.237.94", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T07:23:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T07:24:29Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "110.166.85.77", "classifications": [ "Misc activity", "Information Leak" ], "first_seen": { "$date": "2023-07-05T07:41:08Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T07:41:08Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-ICMP PING Windows", "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "205.210.31.74", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T07:44:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T07:44:15Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "46.145.162.170", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T07:44:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T07:44:56Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "85.208.253.204", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T08:02:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:23:10Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "175.100.24.139", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T08:08:05Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:08:05Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "172.105.25.7", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T08:13:16Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:26:16Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "2.6.56.66", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T08:30:38Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:31:31Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "SSH Login Attempts", "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 2, "tags": [ "tcp", "brute_force", "ssh" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "178.128.64.157", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-05T08:30:58Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:30:58Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "45.15.171.2", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T08:44:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:09:21Z" }, "ports": [ 0 ], "reporting_nodes": 2, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 4, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "198.235.24.69", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-05T08:47:56Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T08:47:56Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "128.199.214.193", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T08:55:49Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:17:43Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 13, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "177.220.180.60", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T08:59:00Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:30:35Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 14, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "3.111.157.107", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T08:59:30Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:30:20Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 11, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "170.187.227.98", "classifications": [ "Attempted Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-05T09:04:54Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:04:54Z" }, "ports": [ 53, 0 ], "reporting_nodes": 1, "rules": [ "PROTOCOL-DNS named version attempt", "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 3, "tags": [ "udp", "icmp" ], "rule_count": 3, "classification_count": 2 }, { "ioc": "118.34.201.246", "classifications": [ "Information Leak", "Misc activity" ], "first_seen": { "$date": "2023-07-05T09:08:50Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:08:50Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP Unusual PING detected", "PROTOCOL-ICMP PING", "PROTOCOL-ICMP Echo Reply" ], "sightings": 5, "tags": [ "icmp" ], "rule_count": 4, "classification_count": 2 }, { "ioc": "64.227.122.198", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T09:24:37Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:31:46Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 3, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "162.248.224.67", "classifications": [ "Misc activity" ], "first_seen": { "$date": "2023-07-05T09:25:11Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:25:11Z" }, "ports": [ 0 ], "reporting_nodes": 1, "rules": [ "ICMP Traffic Detected", "PROTOCOL-ICMP destination unreachable port unreachable packet detected" ], "sightings": 2, "tags": [ "icmp" ], "rule_count": 2, "classification_count": 1 }, { "ioc": "188.166.211.7", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T09:27:45Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:27:45Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 1, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 }, { "ioc": "8.222.129.101", "classifications": [ "Executable code was detected" ], "first_seen": { "$date": "2023-07-05T09:29:15Z" }, "ja3": [], "last_seen": { "$date": "2023-07-05T09:32:34Z" }, "ports": [ 22 ], "reporting_nodes": 1, "rules": [ "INDICATOR-SHELLCODE ssh CRC32 overflow filler" ], "sightings": 6, "tags": [ "tcp", "ssh" ], "rule_count": 1, "classification_count": 1 } ]